SlideShare a Scribd company logo
ครงที่ 4 /2554
                     ั้


                         จ ัดโดย

Thailand Information Security Association (TISA)
    สมาคมความมั่นคงปลอดภัยระบบสารสนเทศแห่ งประเทศไทย



                 © 2011 TISA All Rights Reserved
Agenda




© 2011 TISA All Rights Reserved
TISA MC




© 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved
What is OWASP?




 © 2011 TISA All Rights Reserved
OWASP Local Chapter around the world




        © 2011 TISA All Rights Reserved
OWASP Thailand Chapter




https://www.owasp.org/index.php/Thailand


                                       © 2011 TISA All Rights Reserved
How to Participate




https://www.owasp.org/index.php/Thailand


                                       © 2011 TISA All Rights Reserved
OWASP Thailand Chapter Facebook Fan page




        © 2011 TISA All Rights Reserved
OWASP Top 10 Risks




https://www.owasp.org/index.php/Top_10_2010


                                 © 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved   12
© 2011 TISA All Rights Reserved
Web Application Risks




Outer

        DMZ Zone




Inner

 Server farm Zone
                    © 2011 TISA All Rights Reserved
Your “Code” is Part of Your
                                                       Security Perimeter
                     APPLICATION               Your security “perimeter” has huge
Application Layer


                       ATTACK
                                                holes at the “Application layer”




                                                                                                                      Legacy Systems




                                                                                                                                                                    Human Resource
                                                                                                                                       Web Services
                                                                                                                                                      Directories
                                                                                                          Databases
                                                           Custom Developed




                                                                                                                                                                                     Billing
                                                            Application Code
Network Layer




                                                              App Server
                                                              Web Server
                                                             Hardened OS




                                                                                         Inner Firewall
                                   Outer Firewall




                    You can’t use network layer protection (Firewall, SSL, IDS, hardening)
                                  to stop or detect application layer attacks

                                                       © 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved
OWASP Thailand Mailing-list




https://lists.owasp.org/mailman/listinfo/owasp-thailand



                                                 © 2011 TISA All Rights Reserved
Cloud Security Alliance (CSA)
      Thailand Chapter




                        Thanasin Jitkaew (TISA Volunteer)
                                 SSCP, (IRCA:ISMS), C|EH, CCNA, Network+
                                              PTT ICT Solutions Co.,Ltd.



         © 2011 TISA All Rights Reserved
What is Cloud Security Alliance (CSA)?




-    Established in December 2008
-    Not-for-profit organization (member-driven)
-    With a mission to
      o Promote the use of best practices for providing security assurance within
         Cloud Computing.
      o Provide education on the uses of Cloud Computing to help secure all other
         forms of computing.




Source: https://cloudsecurityalliance.org/about/



                                       © 2011 TISA All Rights Reserved
Who are members of the CSA?




Membership
- Individuals
- Chapters
- Affiliates
- Corporations




Source: https://cloudsecurityalliance.org/membership/



                                     © 2011 TISA All Rights Reserved
What does the CSA offer?



Research
-    Security Guidance for Critical Areas of Focus in Cloud Computing ( >100k downloads)




Source: https://cloudsecurityalliance.org/research/
                                       © 2011 TISA All Rights Reserved
What does the CSA offer?



Research
- Cloud Control Matrix (CCM)
      o   Controls derived from guidance
      o   Mapped to familiar frameworks:
            ISO27001, COBIT, PCI , HIPAA,
            FISMA, FedRAMP
      o   Customers vs. Provider role
      o   Help bridge the “cloud gap” for IT
          & IT auditors




Source: https://cloudsecurityalliance.org/research/ All Rights Reserved
                                        © 2011 TISA
What does the CSA offer?



Research
- Security Guidance for Critical Areas of Focus in Cloud Computing




Source: https://cloudsecurityalliance.org/research/

                                       © 2011 TISA All Rights Reserved
What does the CSA offer?




Research
- Security Guidance for Critical Areas of Focus in Cloud Computing
- Cloud Control Matrix (CCM)
- Top threats to Cloud Computing
- Consensus Assessment Initiative
- Trusted Cloud Initiative
- Cloud Security Alliance GRC Strack
- …




https://cloudsecurityalliance.org/research/



                                       © 2011 TISA All Rights Reserved
CSA Regional Chapters

Regional chapters are essential to the mission of CSA Global to promote the secure
adoption of cloud computing.




         17 chapters                                          36 chapters




                            © 2011 TISA All Rights Reserved
CSA Regional Chapters

Near by?
-   Official  GuangZhou Chapter, Singapore Chapter
-   In Development Hong Kong Chapter, Taipei Chapter, Indonesia Chapter




                              Thailand?




                              © 2011 TISA All Rights Reserved
CSA & OWASP Thailand Chapter Meeting (1/2011)




      © 2011 TISA All Rights Reserved
© 2011 TISA All Rights Reserved
Becoming a chapter


Getting Started

      Apply for your CSA chapter as follows:
            1. Define your chapter’s geographical boundary.
            2. Sign up a minimum of 20 members based within the geography. Provide member’s name, email
            address and LinkedIn URL. If a LinkedIn URL is not available, contact CSA Global for an alternative.
            3. Select a board of directors from within the initial members based upon a consensus process
            developed by the members.
            4. Select a chapter name with the format Cloud Security Alliance, XXXX Chapter.
            5. Send the above application to chapter-startup@cloudsecurityalliance.org




Source: https://cloudsecurityalliance.org/CSA-Chapter-Launch-Guide.pdf



                                        © 2011 TISA All Rights Reserved
TISA Facebook Fan page




                                                      มาเป็ นแฟนกันนะ 




วิธีการเข้ าหรือค้ นหา TISA Fan page :
https://www.facebook.com/pages/TISA/161554843888938    หรือ

                                       © 2011 TISA All Rights Reserved
www.        TISA.or.th
Copyright © 2011 TISA and its respective author
    (Thailand Information Security Association)

        Please contact : info@tisa.or.th


             © 2011 TISA All Rights Reserved

More Related Content

Recently uploaded

Christine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptxChristine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptx
christinelarrosa
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
ScyllaDB
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
operationspcvita
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
DianaGray10
 
Day 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio FundamentalsDay 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio Fundamentals
UiPathCommunity
 
Session 1 - Intro to Robotic Process Automation.pdf
Session 1 - Intro to Robotic Process Automation.pdfSession 1 - Intro to Robotic Process Automation.pdf
Session 1 - Intro to Robotic Process Automation.pdf
UiPathCommunity
 
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during MigrationMust Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
Mydbops
 
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge GraphGraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
Neo4j
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
Antonios Katsarakis
 
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
AlexanderRichford
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
Ivo Velitchkov
 
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdfLee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
leebarnesutopia
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
DanBrown980551
 
Principle of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptxPrinciple of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptx
BibashShahi
 
From Natural Language to Structured Solr Queries using LLMs
From Natural Language to Structured Solr Queries using LLMsFrom Natural Language to Structured Solr Queries using LLMs
From Natural Language to Structured Solr Queries using LLMs
Sease
 
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
zjhamm304
 
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
GlobalLogic Ukraine
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
Fwdays
 
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
inQuba Webinar Mastering Customer Journey Management with Dr Graham HillinQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
LizaNolte
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
AstuteBusiness
 

Recently uploaded (20)

Christine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptxChristine's Product Research Presentation.pptx
Christine's Product Research Presentation.pptx
 
ScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking ReplicationScyllaDB Tablets: Rethinking Replication
ScyllaDB Tablets: Rethinking Replication
 
The Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptxThe Microsoft 365 Migration Tutorial For Beginner.pptx
The Microsoft 365 Migration Tutorial For Beginner.pptx
 
What is an RPA CoE? Session 1 – CoE Vision
What is an RPA CoE?  Session 1 – CoE VisionWhat is an RPA CoE?  Session 1 – CoE Vision
What is an RPA CoE? Session 1 – CoE Vision
 
Day 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio FundamentalsDay 2 - Intro to UiPath Studio Fundamentals
Day 2 - Intro to UiPath Studio Fundamentals
 
Session 1 - Intro to Robotic Process Automation.pdf
Session 1 - Intro to Robotic Process Automation.pdfSession 1 - Intro to Robotic Process Automation.pdf
Session 1 - Intro to Robotic Process Automation.pdf
 
Must Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during MigrationMust Know Postgres Extension for DBA and Developer during Migration
Must Know Postgres Extension for DBA and Developer during Migration
 
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge GraphGraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
GraphRAG for LifeSciences Hands-On with the Clinical Knowledge Graph
 
Dandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity serverDandelion Hashtable: beyond billion requests per second on a commodity server
Dandelion Hashtable: beyond billion requests per second on a commodity server
 
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
QR Secure: A Hybrid Approach Using Machine Learning and Security Validation F...
 
Apps Break Data
Apps Break DataApps Break Data
Apps Break Data
 
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdfLee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
Lee Barnes - Path to Becoming an Effective Test Automation Engineer.pdf
 
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
LF Energy Webinar: Carbon Data Specifications: Mechanisms to Improve Data Acc...
 
Principle of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptxPrinciple of conventional tomography-Bibash Shahi ppt..pptx
Principle of conventional tomography-Bibash Shahi ppt..pptx
 
From Natural Language to Structured Solr Queries using LLMs
From Natural Language to Structured Solr Queries using LLMsFrom Natural Language to Structured Solr Queries using LLMs
From Natural Language to Structured Solr Queries using LLMs
 
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...QA or the Highway - Component Testing: Bridging the gap between frontend appl...
QA or the Highway - Component Testing: Bridging the gap between frontend appl...
 
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
GlobalLogic Java Community Webinar #18 “How to Improve Web Application Perfor...
 
"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota"Choosing proper type of scaling", Olena Syrota
"Choosing proper type of scaling", Olena Syrota
 
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
inQuba Webinar Mastering Customer Journey Management with Dr Graham HillinQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
inQuba Webinar Mastering Customer Journey Management with Dr Graham Hill
 
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
 

Featured

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
Marius Sescu
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
Expeed Software
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
Pixeldarts
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
ThinkNow
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
marketingartwork
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
Skeleton Technologies
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
Neil Kimberley
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
contently
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
Albert Qian
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
Kurio // The Social Media Age(ncy)
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
Search Engine Journal
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
SpeakerHub
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
Tessa Mero
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Lily Ray
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
Rajiv Jayarajah, MAppComm, ACC
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
Christy Abraham Joy
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
Vit Horky
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
MindGenius
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
RachelPearson36
 

Featured (20)

2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot2024 State of Marketing Report – by Hubspot
2024 State of Marketing Report – by Hubspot
 
Everything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPTEverything You Need To Know About ChatGPT
Everything You Need To Know About ChatGPT
 
Product Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage EngineeringsProduct Design Trends in 2024 | Teenage Engineerings
Product Design Trends in 2024 | Teenage Engineerings
 
How Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental HealthHow Race, Age and Gender Shape Attitudes Towards Mental Health
How Race, Age and Gender Shape Attitudes Towards Mental Health
 
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdfAI Trends in Creative Operations 2024 by Artwork Flow.pdf
AI Trends in Creative Operations 2024 by Artwork Flow.pdf
 
Skeleton Culture Code
Skeleton Culture CodeSkeleton Culture Code
Skeleton Culture Code
 
PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024PEPSICO Presentation to CAGNY Conference Feb 2024
PEPSICO Presentation to CAGNY Conference Feb 2024
 
Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)Content Methodology: A Best Practices Report (Webinar)
Content Methodology: A Best Practices Report (Webinar)
 
How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024How to Prepare For a Successful Job Search for 2024
How to Prepare For a Successful Job Search for 2024
 
Social Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie InsightsSocial Media Marketing Trends 2024 // The Global Indie Insights
Social Media Marketing Trends 2024 // The Global Indie Insights
 
Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024Trends In Paid Search: Navigating The Digital Landscape In 2024
Trends In Paid Search: Navigating The Digital Landscape In 2024
 
5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary5 Public speaking tips from TED - Visualized summary
5 Public speaking tips from TED - Visualized summary
 
ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd ChatGPT and the Future of Work - Clark Boyd
ChatGPT and the Future of Work - Clark Boyd
 
Getting into the tech field. what next
Getting into the tech field. what next Getting into the tech field. what next
Getting into the tech field. what next
 
Google's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search IntentGoogle's Just Not That Into You: Understanding Core Updates & Search Intent
Google's Just Not That Into You: Understanding Core Updates & Search Intent
 
How to have difficult conversations
How to have difficult conversations How to have difficult conversations
How to have difficult conversations
 
Introduction to Data Science
Introduction to Data ScienceIntroduction to Data Science
Introduction to Data Science
 
Time Management & Productivity - Best Practices
Time Management & Productivity -  Best PracticesTime Management & Productivity -  Best Practices
Time Management & Productivity - Best Practices
 
The six step guide to practical project management
The six step guide to practical project managementThe six step guide to practical project management
The six step guide to practical project management
 
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
Beginners Guide to TikTok for Search - Rachel Pearson - We are Tilt __ Bright...
 

OWASP and CSA_TISA Pro-Talk_4-2554

  • 1. ครงที่ 4 /2554 ั้ จ ัดโดย Thailand Information Security Association (TISA) สมาคมความมั่นคงปลอดภัยระบบสารสนเทศแห่ งประเทศไทย © 2011 TISA All Rights Reserved
  • 2. Agenda © 2011 TISA All Rights Reserved
  • 3. TISA MC © 2011 TISA All Rights Reserved
  • 4. © 2011 TISA All Rights Reserved
  • 5. © 2011 TISA All Rights Reserved
  • 6. What is OWASP? © 2011 TISA All Rights Reserved
  • 7. OWASP Local Chapter around the world © 2011 TISA All Rights Reserved
  • 10. OWASP Thailand Chapter Facebook Fan page © 2011 TISA All Rights Reserved
  • 11. OWASP Top 10 Risks https://www.owasp.org/index.php/Top_10_2010 © 2011 TISA All Rights Reserved
  • 12. © 2011 TISA All Rights Reserved 12
  • 13. © 2011 TISA All Rights Reserved
  • 14. Web Application Risks Outer DMZ Zone Inner Server farm Zone © 2011 TISA All Rights Reserved
  • 15. Your “Code” is Part of Your Security Perimeter APPLICATION Your security “perimeter” has huge Application Layer ATTACK holes at the “Application layer” Legacy Systems Human Resource Web Services Directories Databases Custom Developed Billing Application Code Network Layer App Server Web Server Hardened OS Inner Firewall Outer Firewall You can’t use network layer protection (Firewall, SSL, IDS, hardening) to stop or detect application layer attacks © 2011 TISA All Rights Reserved
  • 16. © 2011 TISA All Rights Reserved
  • 17. © 2011 TISA All Rights Reserved
  • 19. Cloud Security Alliance (CSA) Thailand Chapter Thanasin Jitkaew (TISA Volunteer) SSCP, (IRCA:ISMS), C|EH, CCNA, Network+ PTT ICT Solutions Co.,Ltd. © 2011 TISA All Rights Reserved
  • 20. What is Cloud Security Alliance (CSA)? - Established in December 2008 - Not-for-profit organization (member-driven) - With a mission to o Promote the use of best practices for providing security assurance within Cloud Computing. o Provide education on the uses of Cloud Computing to help secure all other forms of computing. Source: https://cloudsecurityalliance.org/about/ © 2011 TISA All Rights Reserved
  • 21. Who are members of the CSA? Membership - Individuals - Chapters - Affiliates - Corporations Source: https://cloudsecurityalliance.org/membership/ © 2011 TISA All Rights Reserved
  • 22. What does the CSA offer? Research - Security Guidance for Critical Areas of Focus in Cloud Computing ( >100k downloads) Source: https://cloudsecurityalliance.org/research/ © 2011 TISA All Rights Reserved
  • 23. What does the CSA offer? Research - Cloud Control Matrix (CCM) o Controls derived from guidance o Mapped to familiar frameworks: ISO27001, COBIT, PCI , HIPAA, FISMA, FedRAMP o Customers vs. Provider role o Help bridge the “cloud gap” for IT & IT auditors Source: https://cloudsecurityalliance.org/research/ All Rights Reserved © 2011 TISA
  • 24. What does the CSA offer? Research - Security Guidance for Critical Areas of Focus in Cloud Computing Source: https://cloudsecurityalliance.org/research/ © 2011 TISA All Rights Reserved
  • 25. What does the CSA offer? Research - Security Guidance for Critical Areas of Focus in Cloud Computing - Cloud Control Matrix (CCM) - Top threats to Cloud Computing - Consensus Assessment Initiative - Trusted Cloud Initiative - Cloud Security Alliance GRC Strack - … https://cloudsecurityalliance.org/research/ © 2011 TISA All Rights Reserved
  • 26. CSA Regional Chapters Regional chapters are essential to the mission of CSA Global to promote the secure adoption of cloud computing. 17 chapters 36 chapters © 2011 TISA All Rights Reserved
  • 27. CSA Regional Chapters Near by? - Official  GuangZhou Chapter, Singapore Chapter - In Development Hong Kong Chapter, Taipei Chapter, Indonesia Chapter Thailand? © 2011 TISA All Rights Reserved
  • 28. CSA & OWASP Thailand Chapter Meeting (1/2011) © 2011 TISA All Rights Reserved
  • 29. © 2011 TISA All Rights Reserved
  • 30. Becoming a chapter Getting Started Apply for your CSA chapter as follows: 1. Define your chapter’s geographical boundary. 2. Sign up a minimum of 20 members based within the geography. Provide member’s name, email address and LinkedIn URL. If a LinkedIn URL is not available, contact CSA Global for an alternative. 3. Select a board of directors from within the initial members based upon a consensus process developed by the members. 4. Select a chapter name with the format Cloud Security Alliance, XXXX Chapter. 5. Send the above application to chapter-startup@cloudsecurityalliance.org Source: https://cloudsecurityalliance.org/CSA-Chapter-Launch-Guide.pdf © 2011 TISA All Rights Reserved
  • 31. TISA Facebook Fan page มาเป็ นแฟนกันนะ  วิธีการเข้ าหรือค้ นหา TISA Fan page : https://www.facebook.com/pages/TISA/161554843888938 หรือ © 2011 TISA All Rights Reserved
  • 32. www. TISA.or.th Copyright © 2011 TISA and its respective author (Thailand Information Security Association) Please contact : info@tisa.or.th © 2011 TISA All Rights Reserved