[Owasp-ireland] OWASP Ireland News - August 27th, 2010

fabio.e.cerullo at aib.ie fabio.e.cerullo at aib.ie
Fri Aug 27 09:07:07 EDT 2010


*****************************************************
OWASP Ireland News           August 27th, 2010
*****************************************************

1. OWASP Ireland 2010 Countdown: Third Challenge to win an entry ticket!

2. Visa offers new guidance on securing payment applications

3. Microsoft SDL and the Creative Commons

4. HTML5 Raises New Security Issues

5. SAMM and the Financial Services Industry

6. New Horizons Ireland: Special Offer to OWASP Members & Raffle to Free 
Training Course

------------------------------------------------------------------------

1. OWASP Ireland 2010 Countdown: Third Challenge to win an entry ticket!

We are approaching fast to the biggest Application Security Conference in 
Ireland.

And to make it more exciting we are releasing the following challenge to 
win a FREE ticket!

String uN = ctx.getAuthenticatedUserName();
String paramName = request.getParameter("paramName");
String query = "SELECT * FROM items WHERE owner = '"  + uN + "' AND 
paramName = '" + paramName + "'";

ResultSet rs = stmt.execute(query);

You have to answer the following two questions:

1) What is the fundamental issue with this construct?
2) What is the potential vulnerability?

All answers should be sent to ireland at owasp.org. 

Thanks and best of luck!

You could get all the details about this event including updated agenda, 
keynote speakers, training available, etc in the URL below:

http://www.owasp.org/index.php/OWASP_IRELAND_2010

Did you know? 

By attending OWASP Ireland 2010 you automatically become an OWASP member 
for a year. This applies to all non-members who register to the 
conference.

3. Visa offers new guidance on securing payment applications

Visa on Tuesday announced a set of security best practices for vendors of 
payment applications and for the systems integrators and resellers 
responsible for implementing and managing them.

More on this story: 
http://usa.visa.com/download/merchants/bulletin_payment_app_companies_best_practices.pdf

4. Microsoft SDL and the Creative Commons

I am happy to announce that from this point forward, Microsoft will be 
making their publicly available SDL documentation and other SDL process 
content available to the development community under a Creative Commons 
license. 

By changing the license terms, they are now allowing people and 
organizations to copy, distribute and transmit the documentation to 
others; this means that you can now incorporate content from the SDL 
documents we release under Creative Commons into your internal process 
documentation – subject to the terms specified by the Creative Commons 
license mentioned above. 

You can learn more about the specifics of that license here: 
http://creativecommons.org/licenses/by-nc-sa/3.0/ 

Note that they do not intend to change the licensing for any of the SDL 
tools released by Microsoft – those will continue to use existing 
Microsoft licenses.

Their first two documents for release under a Creative Commons license 
will be the English versions of the “Simplified Implementation of the 
Microsoft SDL” whitepaper and the Microsoft Security Development Lifecycle 
(SDL) - Version 5.0 paper that illustrates how Microsoft applies the SDL 
to our own products and services.  Those releases will be completed over 
the next few weeks. 

Check out Microsoft’s blog page here: 
http://blogs.msdn.com/b/sdl/archive/2010/08/26/microsoft-sdl-and-the-creative-commons.aspx

5. HTML5 Raises New Security Issues

When it comes to new security issues, the security team for the Firefox 
browser have the new version of the Web HyperText Markup Language, HTML5, 
foremost on the mind. 

"Web apps are becoming incredibly rich with HTML5. The browser is starting 
to manage full-bore applications and not just Web pages," said Sid Stamm, 
who works on Firefox security issues for the Mozilla Foundation. Stamm was 
speaking at the Usenix Security Symposium, held last week in Washington 
D.C. 

You could find the full article here: 
http://www.cio.com/article/print/604563

6. SAMM and the Financial Services Industry

The financial services industry is the perfect work stream for frameworks 
like SAMM. Financial services are widely known as the an area which 
invests heavily in areas such as information security, it’s heavily 
regulated (some say not heavily enough) and  a daily challenge to FS is to 
maintain leading edge security but manage costs and usability whilst also 
being compliant with industry regulations,  corporate governance and 
local/regional/global  legislation.

SAMM covers four domains which in turn have sub domains. These four 
“pillars” attempt to examine all aspects of software development, all 
external catalysts which may result in either making security more robust 
or result in weakness.

The beauty of SAMM is its simplicity.

You could find the full article here: 
http://www.opensamm.org/2010/08/samm-and-the-financial-services-industry/

6. New Horizons Ireland: Special Offer & Raffle to Free Training Course

OWASP Ireland had reached an agreement with New Horizons Ireland to offer
its members important discounts to their full range of training courses.

With over 300 centers in 60 countries, New Horizons is the world’s largest
independent IT training company. New Horizons Ireland - Dublin and Galway 
-
delivers a full range of computer training courses; from basic application
and desktop productivity tools to complex and integrated business systems.
Please feel free to visit their website in the URL below for further
details:

http://www.newhorizonsireland.ie

The following courses are currently available on the public schedule:

http://www.newhorizonsireland.ie/LocalWeb/Ireland/Mentored-Learning-Courses.aspx

They also offer the following courses live online:

http://www.newhorizonsireland.ie/LocalWeb/Ireland/OLLCourses.aspx

OWASP members could benefit from a 20% discount on all their courses. In
order to avail this special offer, you need to use the following code when
registering to a training course in their website:

*OWASPIRL*

OWASP IRELAND 2010: SPECIAL RAFFLE

And to celebrate this agreement, OWASP Ireland will raffle 1 place to the
training below absolutely FREE of charge to those who register before 3rd
September to AppSec Ireland 2010. This has been generously given by New
Horizons Ireland and it will be delivered at their Dublin offices in the
near future.

6460 Visual Studio 2008 Connected Systems: Windows Presentation Foundation
http://www.newhorizons.com/LocalWeb/popup/ClassInfo.aspx?ClassID=300003490&ILT=300003490&OLA=&OLL=&ML=&GroupID=462&Mode=3&scheduleclassid=MSM6460

I hope you find this useful to develop your professional career further.

Kind regards,

Fabio Cerullo

************************************************************************************************************************************
The professional association of OWASP Foundation Inc., is always free and 
open to anyone interested in learning more about application security. 
Prior to participating with OWASP please review the Chapter Rules and the 
OWASP overview for some background. As a 501(3)c non-profit professional 
association your support and sponsorship of a meeting venue and/or 
refreshments is tax-deductible and all financial contributions can be made 
online using the online chapter donation button. We encourage organization 
and individual supporters of our ethics & principals to become a voting 
MEMBER. More information on how to become a member could be found here: 
http://www.owasp.org/Membership
************************************************************************************************************************************

******************************************************
This document is strictly confidential and is intended for use by the addressee unless otherwise indicated.

This email has been scanned by an external email security system.

Allied Irish Banks

AIB and AIB Group are registered business names of Allied Irish Banks p.l.c. Allied Irish Banks, p.l.c. is regulated by the Financial Regulator.  Registered Office: Bankcentre, Ballsbridge, Dublin 4. Tel: + 353 1 6600311; Registered in Ireland: Registered No. 24173

Please consider the environment before printing this e-mail. 
******************************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/owasp-ireland/attachments/20100827/37f10292/attachment.html 


More information about the Owasp-ireland mailing list