Denim Group, Ltd.

John Dickson Speaking at Denver ISSA

By Dan Cornell

John Dickson will be speaking at the Denver ISSA meeting this Wednesday (October 21^st, 2009).

Topic: The Permanent Campaign: Driving a Secure Software Initiative in the Enterprise

This presentation focuses on how security officers or development leaders can apply a disciplined approach to building internal consensus to build secure software. A five-step process will be laid out that will enable a manager to characterize the landscape, secure management buy-in, baseline the existing risks, set modest goals and attempt to achieve them, and sustain the initiative. Emphasis will be on actionable steps that successful managers have used to drive the adoption of secure software strategies in large organizations.

Date/Time: Wed. Oct 21st 2009 / 11:30 - 1:30  (NOTE: 3rd Wed. of the month)

Site: Republic Plaza, 370 17th Street, Denver, CO (Downtown Denver)

http://www.issa-denver.org/

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Texas Lyceum Conference on Cybersecurity in San Antonio February 5-6, 2010

By Dan Cornell

The Texas Lyceum is having their February conference in San Antonio and the topic is Internet privacy and security. The Lyceum is a great organization because it integrates both business and public sector leaders and this makes for interesting and lively discussions.  Past Lyceum members include folks such as President George W. Bush, US Senator Kay Bailey Hutchison and Texas Governor Rick Perry.

John Dickson from the Denim Group is a Lyceum member and is also one of the conference organizers. He is helping to coordinate a variety of events for the weekend, including a televised debate on how well current laws protect data and identities in an online world.

This should be an exciting weekend with a lot of thoughtful discussion from bright folks.  You can check out the Business Journal article for more information.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Webinar: How to Jump-Start Your Application Security Knowledge

By Dan Cornell

John Dickson and Jeremiah Grossman will be presenting a webinar on October 19^th at 1pm Central (11am Pacific)

How to Jump-Start Your Application Security Knowledge
For the Network Security Guy Who Knows Nothing about Web Applications

Most security officers are not software developers, and rarely do they have control over the security associated with internally developed software systems. However, CSO's are still frequently held accountable when externally-facing software is compromised and a breach occurs. Unless security professionals radically upgrade their knowledge of software and software development techniques, they will continue to inadequately manage the risk that custom software systems represents to the enterprise.

Presented by John Dickson of Denim Group and Jeremiah Grossman of WhiteHat Security, this webinar will help non-development security managers understand the salient aspects of the software development process and to upgrade their IQ on software. It will help them to identify risks with different assessment approaches, how to inject themselves into the development process at key "waypoints," and to understand ways to influence development peers to write more secure code.

Click here to register.

Live Webinar:
October 19, 2009
1PM CST (11AM PDT)

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Speaking at Austin OWASP on Vulnerability Management

By Dan Cornell

I will be speaking at the Austin OWASP meeting on October 27, 2009 from 11:30 until 1:00.  The meeting is at National Instruments on 11500 N Mopac in Building C.

Title: Vulnerability Management in an Application Security World

Abstract:

Identifying application-level vulnerabilities via penetration tests and code reviews is only the first step in actually addressing the underlying risk. Managing vulnerabilities for applications is more challenging than dealing with traditional infrastructure-level vulnerabilities because they typically require the coordination of security teams with application development teams and require security managers to secure time from developers during already-cramped development and release schedules. In addition, fixes require changes to custom application code and application-specific business logic rather than the patches and configuration changes that are often sufficient to address infrastructure-level vulnerabilities.

This presentation details many of the pitfalls organizations encounter while trying to manage application-level vulnerabilities as well as outlines strategies security teams can use for communicating with development teams. Similarities and differences between security teams’ practice of vulnerability management and development teams’ practice of defect management will be addressed in order to facilitate healthy communication between these groups.

As always, OWASP meetings are open to all and free.  Hope to see folks there.

More information can be found on the OWASP Austin website.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Denim Group: Inc 5000 Two Years in a Row

By Dan Cornell

This was mentioned a while back, but Denim Group made the Inc 5000 list of fastest-growing privately-held companies in America for the second year in a row.

The press release is here:

·         Denim Group Named to Inc. Magazine 5000 List of Fastest Growing Companies For 2nd Year in a Row

You can also check out our online Inc 5000 profile.

Many thanks to all Denim Group’s customers for allowing us to serve them.  Also thanks to Denim Group’s great employees – we couldn’t do it without you.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

OWASP San Antonio: Next Meeting October 21st, 2009

Sponsored by:

San Antonio OWASP Chapter: October 21, 2009

Topic: Rolling Out an Enterprise Source Code Review Program

Presenter: Dan Cornell, Principal at Denim Group

Date: October 21, 2009 11:30 a.m. – 1:00 p.m.

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

Source code review technology has rapidly advanced over the past several years and offers great promise of helping organizations detect and address software security defects.  However, many organizations stumble as they try to roll out these technologies because they fail to understand the people and process issues that must also be addressed.  This talk will present lessons learned from the creation of several enterprise source code review programs, including: identifying all sources of custom code in an organization including custom extensions to ERP systems and enterprise portals, selecting the first round of applications to scan and successfully interpreting results and driving resolution to identified issues.

Presenter Bio:

Dan Cornell has over ten years of experience architecting and developing web-based software systems. As CTO of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group security research team, investigating the application of secure coding and development techniques to the improvement of web-based software development methodologies.

 

Dan Cornell has performed as the CTO of BrandDefense, as founder and Vice President of Engineering for Atension prior to its acquisition by Rare Medium,  Inc. and as the Vice

President, Global Competency Leader for Rare Medium’s Java and Unix Competency Center. Cornell has also developed simulation applications for the Air Force with Southwest

Research Institute.

Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the chapter leader of the San Antonio chapter of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, Denim Group's open source tool for assessing the security of AJAX-enabled web applications.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

Posted via email from denimgroup's posterous

DarkReading Coverage of WhiteHat Sentinel / Snort Integration by Denim Group

By Dan Cornell

Today Dark Reading covered the integration between WhiteHat Sentinel and Snort we built.  As I mentioned Tuesday – this was a really cool project.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

WhiteHat Sentinel and Snort Integration by Denim Group

By Dan Cornell

A great thing about working at Denim Group is that folks get to work on a bunch of really cool cutting-edge projects with a lot of great, name-brand companies.  An unfortunate drawback of working at Denim Group is that we usually can’t talk about the projects we work on.

That is why we were especially excited to have the opportunity to work with WhiteHat Security to create an integration between their Sentinel website risk management solution and the Snort® IPS.  This allows users of the Sentinel service to create ultra-targeted Snort IPS rules for their web applications based on actual identified vulnerabilities.

There are a couple of press releases online with more info:

·         WhiteHat Security Adds Denim Group as Its Premium Integration Partner

·         WhiteHat Security Takes Snort® to the Next Level

I think this type of integration is going to be even more prevalent going forward and we were excited to have the opportunity to put this together.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

5 More Things a Web Application Attacker Won't Tell You

By Dan Cornell

We had some great follow up and suggestions from folks after our previous post on “13 Things a Web Application Attacker Won’t Tell You”.  We though we’d repeat some here:

·         @vidluther: “Just because you’re using a frameworks doesn’t mean your application is secure”

·         @dcuthbert: “Bad guys don’t use a browser to attack your web application”

·         Aaron Lognion: “I love when your site let's me upload files under your web root somewhere”

·         Aaron Lognion: “I can intercept and steal just about anything you pass over http that is not SSL or otherwise encrypted”

Jeff Williams also sent a mention of his OWASP article on How to Write Insecure Code.

All great info!

I’d also propose:

·         “Security through obscurity … isn’t”

This is a humorous look at a serious issue.  Too many developers a) don’t have deep enough knowledge of how to develop software in a secure manner and b) incorrectly assume “it could never happen to me.”  It is a scary world out there, and that world runs on software.  The organizations developing that sofware need to step up and start doing it properly.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Robert Scoble Interview of Denim Group's John Dickson and Dan Cornell

via building43.com

Robert Scoble interviewed John and I at the Rackspace offices a while back and the interview video is now online. We talked about a variety of application security topics including penetration testing, code review, developer training and the Open Web Application Security Project (OWASP).

Many thanks to Scoble and the rest of the folks at Rackspace/Building43!

--Dan
dan _at_ denimgroup.com
@danielcornell

Posted via web from denimgroup's posterous