Join us for Bay Area OWASP's upcoming event, Great talks, delicious food Courtesy our sponsors **Kodem Security.** Get ready for insightful discussions and the chance to network with some of the brightest minds in the industry.
**This meetup is jointly hosted with Pacific Hackers Group and and Cloud Thirsty Thursday.**

**Agenda:**
5:30 - 6:00: Doors open, networking and food
6:00 - 6:45: Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker
6:45 - 7:30: **TBD**
**Talk#1**
Abstract: This presentation explores Adversarial Intelligence - an approach that views application security from an attacker’s perspective. Drawing from vulnerability research experience at the NSO Group, the speaker will highlight how overlooked low and medium vulnerabilities can be combined to execute successful attacks. By examining attack chains and application runtime behavior, attendees will see how gaps often missed by traditional methods are exposed. Attendees will learn about effective tools and techniques for detecting and mitigating these threats, especially in cloud-native and distributed systems. Designed for security practitioners and academics, this session provides a deeper understanding of defending against sophisticated attackers by adopting their mindset.

Speaker :- **Roy Talyosef** is a founding engineer at Kodem. Prior to Kodem, he was on the Vulnerability Research team at NSO Group and worked on the team that built Pegasus.”

Talk#2: TBD

Bay Area OWASP

prashant

Gadi Bashvitz

Michelle Mehrayin

December OWASP Meetup

Hacker Dojo

Hi,
This time we will focus on threat modeling - a proactive technique of risk analysis which could help to determine and fix potential vulnerabilities before they will even appear in the code, configuration or architecture.
Nowadays "threat modeling" has become a trendy buzz word. During our meetup we will try to uncover it's real meaning and discuss how to practically implement threat modeling in software development lifecycle.

Agenda:

1. **Threat modeling for application security – a case study**
*Marta Rusek (Senior Cloud Security Engineer) & Wiktor Cudek (Principal Cloud Security Engineer) - Pegasystems.*
Threat modeling is one of the parts of the SDLC process, that embed security throughout early stages of development. Thanks to that, we are able to detect potential problems at the beginning and avoid a lot of changes on the advanced maturity of the product.
The goal of this presentation is to compare the most well-known Threat
Modeling methodologies, their strong and weak sides. Based on our knowledge, we will compare these methods with the process and tools that are used in our company, and share our experience based on the work with development teams.
2. After the break, we will host a **discussion about threat modeling**. Share our experiences with TM. When it's applicable. How to start doing TM in your project? Which techniques and methodologies works and when? What should be our goals? Is it possible to simplify the threat modeling process? That's just example of questions that we want to ask.

Please RSVP and save the date!
If you have a minute, **please share this invitation** with friends and in your social media.

OWASP Poland

Wojciech Dworakowski

Jakub Mackowski

Jakub

OWASP Meeting in Krakow - Threat Modeling

Techie's

🐝✡ OWASP IL ✡🐝 is excited to announce our next Meetup! 🚀
Join us for an evening filled with engaging discussions on application security, networking with the AppSec community, and of course, delicious food and drinks.
We’re thrilled to have this event graciously hosted by JFrog at their amazing offices. Don’t miss this opportunity to connect, learn, and grow with fellow security enthusiasts!

====================================================================
**Agenda:**
➡️ 18:00 - 18:20 - gathering and food - We will gather at JFrog's Offices for drinks, great treats, and mingling.
➡️ 18:20 - 18:30 - Keynote + Microphone tuning
➡️ 18:30 to 19:15 - **Hacking Like a Developer: Applying a Developer Mindset to Blackbox Penetration Tests**
*Moti Harmats - Product Security Team Leader @ JFrog*
In this session, we’ll explore how adopting a developer’s mindset can elevate your penetration testing techniques and uncover vulnerabilities more effectively. By leveraging tools like debuggers, developer tools, and runtime analysis, even without access to source code, you can gain deeper insights into application behavior.

We’ll cover practical techniques for using these tools in blackbox environments, demonstrating how to trace application flows, identify critical breakpoints, and manipulate data to expose security flaws. Whether you’re a seasoned pentester or just getting started, this talk will equip you with actionable techniques to think like a developer, hack like a pro, and improve the value of your penetration tests.

Small Break - 19:15 - 19:20

➡️ 19:20 - 20:05 - **Secure Your Gen Code**
*Or Sahar -CoFounder @ Secure From Scratch*
GenAI tools have transformed the way developers write code, but in many cases, this code does not adhere to secure coding practices. In this talk, we’ll carefully examine how GenAI generates vulnerable code snippets and explore ways to generate secure ones.

This talk is designed for developers and team leads looking to leverage GenAI responsibly while ensuring code quality and security.

Small Break - 20:05 - 20:15

➡️ 20:15 - 21:00 - **DOM Jungle - Can We Trust The UI?**
*Gal Weizman - Security Engineer @ MetaMask*
One thing's for sure—we can no longer fully trust all code running under the same origin as our app. This is due to today's development landscape, where web apps are mostly composed of third-party code that the app builders do not control.
Considering this, we can no longer trustfully perform many operations we are used to blindly trusting. A significant one is DOM interaction—if some code I don't trust can run in my app, how can I rest assured it doesn't manipulate the DOM and the content accessible to the user? If I present sensitive content to the user, can an attacker just steal it? What stops an attacker from changing my website's layout to phish the user?
The way the Web is designed, any JavaScript code running within a certain origin has full access to its document. Due to how the DOM's API is designed, regulating restrictions on it is a hard problem to solve—many have tried (and still are).
In this talk, after making sure it's clear why DOM API is so complicated to confine, we'll discuss why we should worry about this problem, what we can do about it, and, most importantly, what projects/initiatives/proposals are already being worked on.

====================================================================
This event is hosted by JFrog in collaboration with OWASP Israel.
Join us at the event physically as we will not include Zoom or remote participation this time.

OWASP Israel Chapter

Sharon Ohayon

Uriel Yair

Gilad Bronstein

OWASP IL Meetup - December 2024

JFrog Offices

Join us in celebrating yet another end to an amazing year. No presentations, just a catch up with all you hackers, security experts and enthusiasts alike.
Tell us about sweet hacks you’ve done or things you’ve heard about.
Hope to see you there!

OWASP Brisbane Chapter

Wade

Ramsey Tafili

End of year celebration!

Pig 'N' Whistle King George Square

**OWASP Meeting 2024**

OWASP Lima Chapter Meeting (VIA ZOOM)

**PRESENTACIÓN:**
**OWASP Projects: A Path to a Secure SDLC**

Explora los principales proyectos de OWASP y cómo integrarlos en cada etapa del Ciclo de Vida de Desarrollo de Software (SDLC) para garantizar la seguridad desde el diseño hasta la implementación. Conoce herramientas y estándares como OWASP Top 10, ASVS y ZAP, y su impacto en la construcción de software seguro y eficiente. Una oportunidad para profundizar en las mejores prácticas respaldadas por la comunidad global de OWASP.

OWASP Lima Chapter

Carlos Ganoza Plasencia

Elysa García

Fernando Flores

OWASP Meeting 

Online event

OWASP® Foundation 

{networkName}を検索する

グループ

{PRO_NETWORK_NAME}はMeetup Proに登録しており、世界中の{PRO_GROUP_COUNT}のMeetupで{PRO_MEMBER_COUNT}人以上のメンバーが参加しています。Meetup Proは、ユーザー、パートナー、コントリビューター、メンバーのネットワークを管理できるプロフェッショナルなコミュニケーションツールです。

The  OWASP® is a thriving global community that drives visibility and evolution in software safety and security. We are a community of like-minded security and development professionals who discuss security from various perspectives with their local peers and our worldwide community. You can learn more about OWASP, our open-source projects, and our current activities at www.owasp.org.  

You can support OWASP by becoming an individual or corporate member here: https://owasp.org/membership/.

For further information, visit the https://owasp.org/contact

The OWASP® Word Mark and Design™ Logo are registered or unregistered service marks of OWASP Foundation, Inc. in the United States and other countries. All rights reserved. Unauthorized use is strictly prohibited.


OWASP® Foundation

OWASP® Foundation

2023 OWASP Global AppSec Washington, DC

OWASP® Foundation

私たちについて

OWASP® Foundation を検索する

今後のイベント

グループ