CHICAGO (November 9, 2010) - Security experts from Trustwave, the leading provider of information security and compliance solutions, will present at OWASP AppSec DC 2010, November 10 and 11. The presentations will be delivered by members of SpiderLabs, the advanced security team at Trustwave responsible for application security, incident response, penetration testing, physical security and security research.
- Andrew Wilson will deliver PenTesting with Iron, which will look at Ruby and Python, two programming languages commonly used in security testing, and how they are now able to interact and test Microsoft-based enterprise applications through IronRuby and IronPython. Though these languages are a cornerstone of security testing, both Ruby and Python were not previously able to communicate with Microsoft's .NET, an application framework frequently used to create enterprise applications. Through Microsoft's new dynamic language support, penetration testers can now use IronRuby and IronPython to test the security of enterprise applications while retaining many of their common tools. This presentation will highlight best of breed approaches toward getting the most value of these frameworks.
- Ryan Barnett will present The Web Hacking Incident Database (WHID) Report, which is a Web Application Security Consortium (WASC) project dedicated to maintaining a database of Web application-related security incidents and led by the presenter. The report analyzes the business impact of Web application security attacks and reviews compiled data from January through June, 2010. This presentation will analyze drivers for Web hacking incidents, top attack methods and will review various outcomes of the successful attacks in the WHID, all of which can lead to serious consequences. The presentation also will look at reasons why organizations cannot properly respond to Web hacking incidents and how they can best secure themselves.
- Ryan Barnett will also present the OWASP ModSecurity Core Rule Set. ModSecurity is an open source Apache Web server module that provides a Web application firewall engine. It is developed and maintained by the SpiderLabs Research team. The ModSecurity Rules Language engine is extremely flexible and robust and has been referred to as the "Swiss Army Knife of Web application firewalls." In order to enable users to take full advantage of ModSecurity out-of-the-box, the OWASP ModSecurity Core Rule Set (CRS) was created, which provides critical protections against attacks across most Web architectures. This presentation will provide a walk-through of the CRS protection capabilities for Web applications.
- John Hoopes and Andrew Wilson will deliver Code Reviewing Strategies, which will look at the difficult task of reviewing thousands of lines of code efficiently and effectively. This presentation outlines many of the common practices, strategies and tools used by professional reviewers to keep focused and find vulnerabilities. Specific topics will cover comprehensive code reviews, auditing for specific vulnerabilities, design review, hybrid approaches and the OWASP code review guidelines.
"As more businesses take their ventures online, it's critical that application security is top of mind," said Robert J. McCullen, chairman and CEO of Trustwave. "These presentations will provide the insight into critical security measures that will help businesses protect their online presence."
"Businesses often assume that applications without critical data don't need the same type of protection as those that store such data," says Nicholas J. Percoco, senior vice president and head of Trustwave's SpiderLabs. "Insecure applications are often the gateway into network environments, which is why businesses need to follow security best practices with all applications."
About Trustwave
Trustwave is a leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper® compliance management software and other proprietary security solutions including SIEM , WAF , EV SSL certificates and secure digital certificates . Trustwave has helped hundreds of thousands of organizations-ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers-manage compliance and secure their network infrastructures, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, Asia and Australia. For more information, visit https://www.trustwave.com/en-us/.
