Developing Security

Crossing the Border - JavaScript Exploits

Recently I had the pleasure of giving an OWASP presentation on JavaScript Exploits. I had some fun with the talk and compared countermeasures used to prevent JavaScript Exploits to Chinese border security.



I really appreciate all of the people who came out both in Ottawa and Montréal, and the feedback I received was really positive. A special thanks to the chapter leaders for making this possible.



If you are interested in giving a presentation to either of these OWASP chapters, they are always looking for volunteers. More information can be found on the Ottawa OWASP or Montréal OWASP pages.



Download the PDF (3.3 MB) or view the slides below (if your reader supports iframes).

OWASP Ottawa Sept 10th, Montreal Sept 17th

It's OWASP time again, and the speaker this time around is... well, me. :)

I'm going to be giving a presentation based on ongoing research into detection and prevention of JavaScript exploits. Here's the official outline:

Crossing the Border – JavaScript Exploits

JavaScript-based exploits are a serious threat on the Internet today. This talk explores how the countermeasures to deal with script based attacks parallel 2200 years of Chinese border security. The speaker will cover the benefits and drawbacks of current prevention methods and introduce future techniques to keep bad scripts at bay.

If you're not familiar with OWASP, local chapter meetings are FREE and open to anyone who wants to attend. Simply RSVP and come out to meet other information security professionals.

Ottawa (more details)

When: Thursday September 10th, 2009 6:00pm
Where: 40 Hines Road Suite 200 in Kanata
Schedule:

6:00-6:30 Food and drinks
6:30-7:30 Main presentation
7:15-8:00 Open discussion and questions

Register: owasp.ottawa at gmail.com

Montréal (more details)

When: Thursday September 17th, 2009 18h00
Where: École de Technologie Supérieure, 1100, Rue Notre-Dame Ouest, Montréal, Room: A-1424
Schedule:

18:00-18:05 Welcome speech by Chapter Leader
18:05-18:15 Welcome speech by sponsors
18:15-19:00 Main presentation
19:00-19:15 Open discussion
19:15-... End of the meeting at the ETS Pub

Register: owaspmontreal at gmail.com

I really appreciate the opportunity to share information on this topic. Thanks to OWASP, the sponsors and especially the chapter leaders Sherif Koussa and Benoit Guerette for putting this together.

See You There!

Social Security

For my 10th post I thought I would chronicle the amazing experience I have had launching this blog and becoming a more active member of the information security community.

Alan Shimel coined the term 'Social Security' and despite its unfortunate overlap with benefits for the retired and disabled, it really fits. To me 'Social Security' is the act of sharing information security knowledge for the common good. The 200+ bloggers of the Security Bloggers Network give freely of their time and knowledge and many of them have to do so outside of normal work hours in order to keep their posts free of sales pitches ;) Many of the same bloggers are highly accessible on another great tool of the Social Security space, Twitter. Specifically the ever growing list of Security Twits carefully maintained by @quine who's members are a fountain of information.

One month ago today I launched my blog, Developing Security. I'm a Software Architect and I wanted to share my experiences developing (secure) security software. Alan Shimel was gracious enough to add me to SBN providing for an instant readership (and of course, pressure!). I also joined Twitter at the same time and followed many of the members of the Security Twits list. One of the people who noticed that I followed him was Rafal Los. He was setting up an OWASP tour and noticed that my location was on the stop. He asked me if I was aware of the event and going to attend. Long story short, I ended up being involved hosting the meeting and got a great opportunity to meet Raf. Had it not be for Twitter and 'Social Security' that's likely the first of many opportunities that would have passed me by.

Every day, the power of Twitter really continues to surprise me. Once I asked about Javascript exploits (one of my favorite topics) and within a minute I was pointed down another direction that aided my research. Another time I complained about the excessive sound effects on the OWASP podcast and Jim Manicode, who produces the podcast, saw this. After an email exchange Jim agreed with my opinion, and now the latest podcasts aren't loaded with effects. Would I have complained before Twitter? Likely not. By following the Security Twits I have discovered so many more podcasts, webcasts, groups and articles. Often this information appears on Twitter before you can find it on other sources. I've also been pleasantly surprised by the people who choose to tweet about blog posts I have written. The positive comments are really appreciated.

One month and 10 posts in, I'm really enjoying this new world. For anyone remotely thinking about starting an information security blog or joining the Security Twits, I would highly recommend it. Its definitely been a highly valuable excursion for me.

For the next couple of weeks I'll be on the road demonstrating Third Brigade's VMsafe-based Virtual Appliance. If you happen to be at the VMware Partner Exchange in Orlando (April 14 - 16), please drop by the vCloud pavilion. I've been working with a great team on our Virtual Appliance and it's exciting to get a chance to show it off. I'll be writing more about VMsafe and other efforts to apply security at the virtualization layer in the future. It's a project that I have been deeply involved with and it's very interesting subject matter.

The following week I'll be at RSA either at the sessions or at booth 538. I'm also really exited to be attending the Security Bloggers Meetup. These people are celebrities to me and I look forward to meeting them! If you would like to find me at RSA just message me on Twitter @justin_foster.

OWASP Ottawa Meeting - Monday April 6th, 2009 (with Rafal Los)

It's been a while but OWASP Ottawa is back! And what better way to kick off the new season than with speaker Rafal Los (Blog Twitter). Rafal is going to be speaking about Web Applications:

Web Applications – A Brutal Truth Web applications are a company’s face to the world, but unfortunately for us in security there are more problems than we have solutions. In this talk you’ll hear the real, brutal truth, and get an idea of the types of attacks and issues you’ll be dealing with for the foreseeable future. This talk focuses on web application mistakes, the attack vectors that exploit them, and defenses against all of it… it’s a tough Internet – make sure you know.

About The Speaker Rafal Los is currently a Sr. Security Consultant with Hewlett-Packard’s Application Security Center (ASC). Rafal has over 13 years of experience in network and system design, security policy and process design, risk analysis, penetration testing and consulting. Over the past eight years, he has focused on Information Security and Risk Management, leading security architecture teams and managing successful enterprise security programs for General Electric and other Fortune 100 companies, as well as SMB enterprises. Previously Rafal spent three years in-house with GE Consumer Finance, leading its security programs.

If you're not familiar with OWASP, local chapter meetings are FREE and open to anyone who wants to attend. Simply RSVP to owasp.ottawa@gmail.com. Come on out and meet Rafal, the chapter leaders Sherif Koussa and Mike Suse, and other Ottawa developers and information security professionals.

When: Monday April 6th, 2009 6:00
Where: 40 Hines Road Suite 200 in Kanata
Schedule:

6:00-6:30 Food and drinks
6:30-7:30 Main presentation
7:15-8:00 Open discussion and questions

The meeting has had a last minute change of location to the Third Brigade office at 40 Hines Rd in Kanata (Map).

See You There!