OWASP AppSec Ireland and DC

OWASP AppSec Ireland is a week away! If you happen to be in Dublin, Ireland next Friday, come by and say "Hi!" I will be presenting "Microsoft's Security Development Lifecycle for Agile Development".  More information is available here:

http://www.owasp.org/index.php/OWASP_IRELAND_2010#Agenda_and_Presentations_-_September_17

I was also accepted to speak at OWASP AppSec DC on November 10th or 11th. This will be the first time I will give the SDL-Agile presentation at a conference in the United States!  The conference home page is: http://www.owasp.org/index.php/OWASP_AppSec_DC_2010

I'm Presenting at OWASP AppSec Research 2010 Conference

The OWASP AppSec Research 2010 conference is being held on June 23rd and 24th 2010 in Stockholm, Sweden.  I will be speaking on the 24th at 11:10 AM on "Microsoft's Security Development Lifecycle for Agile Development".  Here is a link to the schedule for June 24th:
http://www.owasp.org/index.php/OWASP_AppSec_Research_2010_-_Stockholm,_Sweden#tab=June_24

I hope to see lots of people there!

.NET User Group Presentation - Microsoft SDL-Agile

I had a great time giving my Microsoft SDL-Agile v2 presentation last night at the Kansas City .NET User Group Meeting.  Several people asked for the slides, so I made them available as a PDF document here: Microsoft SDL-Agile Presentation - Nick Coblentz V2 2010-03-23.pdf

Many also wanted links to the tools I mentioned during the presentation.  Here is a list of those tools:

• SDL Process Guidance 4.1a (includes SDL-Agile towards the bottom of the document
• CAT.NET v2, Web Protection Library (Includes Anti-XSS Library and Security Runtime Engine), and the Web Application Configuration Analyzer 
• web.config security analyzer
• Microsoft FxCop 1.36
• Microsoft Code Analysis Tool .NET (CAT.NET) v1 CTP - 32 bit (Old version of CAT.NET)
• Microsoft Code Analysis Tool .NET (CAT.NET) v1 CTP - 64 bit (Old version of CAT.NET)
• BinScope Binary Analyzer
• MiniFuzz File Fuzzer
• MSF-Agile plus Security Development Lifecycle Process Template for VSTS 2008
• Microsoft SDL Process Template For Visual Studio Team System
• Microsoft SDL Threat Modeling Tool

Finally, here are links to the code used to demonstrate the Web Protection Library:

• Default.aspx
• Default.aspx.cs
• Default.aspx.designer.cs
• Web.config

Please feel free to email me with any questions or comments about the presentation.

Microsoft SDL-Agile Presentation Slides

I wanted to thank everyone who came to the OWASP Kansas City Chapter meeting tonight. I had fun presenting.

A copy of the slides are available here: OWASP Kansas City, Microsoft SDL-Agile Presentation

Unfortunately the animations don't work in the PDF version, but I would be happy to present at other meetings, user groups, or for a group of developers/managers within a company. If you are interested, please feel free to email me. My contact information is listed in the sidebar of this blog.

OWASP Presentation on Dec. 10: Microsoft SDL-Agile

I will be giving an OWASP presentation on December 10th over the Microsoft Security Development Lifecycle for Agile Development. The presentation will be about 45 minutes and is scheduled to begin at 6PM in Regnier Center Room 270 at JCCC.

Here is the original announcement from the OWASP Kansas City List: https://lists.owasp.org/pipermail/owasp-kansascity/2009-November/000085.html

Microsoft SDL for Agile Development

Microsoft recently released a document describing how to apply the SDL process to Agile development. Take a look at their blog post or download the document here.

Microsoft SDL Process Template

Microsoft has released a Visual Studio module that helps developers adhere to Microsoft's SDL process. This tool has a whole lot of things right such as:

• Ensuring developers complete security activities before checking in code
• Providing a workflow for developers to follow
• Providing SDL process steps, instructions, descriptions, and resources to developers

Tools, such a the SDL Process Template released by Microsoft, can greatly increase the success rate of an organization's migration towards a secure software development process. Once organizations define their own custom secure development process, a similar approach should be used to help make adherence easier.

Check out the video on the following page for more information:
http://msdn.microsoft.com/en-us/security/dd670265.aspx