Denim Group, Ltd.

Denim Group: Inc 5000 Two Years in a Row

By Dan Cornell

This was mentioned a while back, but Denim Group made the Inc 5000 list of fastest-growing privately-held companies in America for the second year in a row.

The press release is here:

·         Denim Group Named to Inc. Magazine 5000 List of Fastest Growing Companies For 2nd Year in a Row

You can also check out our online Inc 5000 profile.

Many thanks to all Denim Group’s customers for allowing us to serve them.  Also thanks to Denim Group’s great employees – we couldn’t do it without you.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

OWASP San Antonio: Next Meeting October 21st, 2009

Sponsored by:

San Antonio OWASP Chapter: October 21, 2009

Topic: Rolling Out an Enterprise Source Code Review Program

Presenter: Dan Cornell, Principal at Denim Group

Date: October 21, 2009 11:30 a.m. – 1:00 p.m.

Location:

San Antonio Technology Center (Web Room)

3463 Magic Drive

San Antonio, TX 78229

View Larger Map

Abstract:

Source code review technology has rapidly advanced over the past several years and offers great promise of helping organizations detect and address software security defects.  However, many organizations stumble as they try to roll out these technologies because they fail to understand the people and process issues that must also be addressed.  This talk will present lessons learned from the creation of several enterprise source code review programs, including: identifying all sources of custom code in an organization including custom extensions to ERP systems and enterprise portals, selecting the first round of applications to scan and successfully interpreting results and driving resolution to identified issues.

Presenter Bio:

Dan Cornell has over ten years of experience architecting and developing web-based software systems. As CTO of Denim Group, he leads the organization’s technology team overseeing methodology development and project execution for Denim Group’s customers. He also heads the Denim Group security research team, investigating the application of secure coding and development techniques to the improvement of web-based software development methodologies.

 

Dan Cornell has performed as the CTO of BrandDefense, as founder and Vice President of Engineering for Atension prior to its acquisition by Rare Medium,  Inc. and as the Vice

President, Global Competency Leader for Rare Medium’s Java and Unix Competency Center. Cornell has also developed simulation applications for the Air Force with Southwest

Research Institute.

Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and is currently the chapter leader of the San Antonio chapter of the Open Web Application Security Project (OWASP). He is a recognized expert in the area of web application security for SearchSoftwareQuality.com and the primary author of Sprajax, Denim Group's open source tool for assessing the security of AJAX-enabled web applications.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

Posted via email from denimgroup's posterous

New Denim Group Team Members

John E., Team Consultant
John joins Denim Group with nine years of experience in the IT industry. John’s past roles include working as an independent Web Developer and as a Programmer/Developer for companies such as EDS, J.D. Edwards and Prologic Technology Systems. John enjoys learning about pragmatic software development methodologies, is a member of the Austin chapter of OWASP and has a Bachelor of Science degree in Management Information Systems from the University of Illinois at Urbana-Champaign.

Jennifer S., Team Consultant
Jennifer joins Denim Group with an extensive background in freelance web design. A member of the Austin Dot Net User Group, Jennifer has a Bachelor of Science degree in Computer Science from the University of Texas and has worked for companies such as BuildASign.com, United States Geological Survey and IBM.

Kyle P., Team Consultant
Kyle joins Denim Group with nine years of experience in the IT arena. In the past, Kyle has worked with ASNA as a Software Tester, Software Engineer and Lead Project Developer, and has a Bachelor of Science degree in Computer Science from UTSA.

Dorinda R., Sales Support Associate
Dorinda joins Denim Group as Assistant to Denim Group’s Business Development Managers, and she is in charge of helping to coordinate sales efforts. Her past experience includes five years of customer service with SBC, management of circulation for the San Antonio Current, and the coordination of programming, promotions and sales for a local radio station.

Efren S., Business Development Manager
Efren joins Denim Group as a Business Development Manager with a marketing background, having interned with Frost Bank and Guerra DeBerry Coody. A member of ISSA and OWASP, Efren has a Bachelor of Science degree in Business Administration from Trinity University.

Work Hard, Play Hard, and e-Learn

We have our share of characters here at Denim Group – brilliant folks who like to work hard and play hard.  Lately we have been putting a lot of work into the upcoming quarterly update of our ThreadStrong application security e-Learning product.  This is a pretty major revision with audio, demonstrations and interactive exercises.  I got a kick out of this email exchange and thought I would post it online.

-----Original Message-----

From: Michael

Sent: ...

To: ...

Subject: e-Learning - Meeting notes - storyboard planning

 

> All:

>

> Here is what we came up with during our storyboard meeting:

>

> -New order for the sections will be:

> 1. Breaches

> 2. Attack demonstration

> 3. What/Why

> 4. SQL injection

> 5. HTTP Basics

> 6. XSS

> 7. Quiz

>

I believe that covers it. I took this picture from the meeting.

-----Original Message-----

From: Bryan

Sent: ...

To: ...

Subject: e-Learning - Meeting notes - storyboard planning

Wow, you know, I'd noticed during today's meeting that we had a lot more productive and intelligent discussion. I was looking back at notes from the last meeting and I think I figured out what our problem was.

Like I said – a real cast of characters.

--Dan

dan _at_ denimgroup.com

@danielcornell

Posted via email from denimgroup's posterous

Java User Group San Antonio meeting 6:00 Sep 3, 2009 at New Horizons

http://groups.google.com/group/satjug/web/jug-poster.pdf

The inaugural meeting of the Java Users Group of San Antonio will be Wednesday September 3rd, 2009 at New Horizons at 6:00pm. The presentation will be "Programming in Scala"

Posted via email from denimgroup's posterous

Dan Cornell Presenting at OWASP Houston: Conducting Application Assessments

TOPIC: "Conducting Application Assessments"

SPEAKER(S): Dan Cornell, OWASP, Denim Group

ABSTRACT: This talk will review a number of application assessment techniques and discuss the types of security vulnerabilities they are best suited to identify as well as how the different approaches can be used in combination to produce more thorough and insightful results. Code review will be compared to penetration testing and the capabilities of automated tools will be compared to manual techniques. In addition, the role of threat modeling and architecture analysis will be examined. The goal is to illuminate assessment techniques that go beyond commodity point-and-click approaches to web application or code scanning.

Date: Wednesday, September 9th

Time: 6:00 - 7:30pm

Location: HCC
1010 West Sam Houston Parkway North
Spring Branch Campus Commons
Houston, TX 77043

Directions: Physically it is Beltway 8 and I-10 -- Take the Gesner Exit of I-10 from downtown. It is next door to Murphy's Deli.

Contact me for a parking pass: dan _at_ denimgroup.com / @danielcornell

Posted via web from denimgroup's posterous

Social Networking Security Slide Deck Online

By Dan Cornell

John Dickson gave a presentation on the security implications of social networking to a group of CSOs last week.  The slide deck is now online at SlideShare:

Social Networks and Security: What Your Teenager Likely Won't Tell You

View more documents from Denim Group.

John's main point is that CSOs need to approach social networking as a business issue rather than a security issue if they want to maximize their ability to influence policy and implementation.

--Dan
dan _at_ denimgroup.com
@danielcornell

Denim Group and Fortify Press Release

By Dan Cornell

We released a press release today about our use of Fortify's tools on our software development projects.  John has a video describing the release here:

Press release is here.
Business Journal coverage is here.

--Dan
dan _at_ denimgroup.com
@danielcornell

OWASP San Antonio Meeting: Wednesday August 19, 2009

By Dan Cornell

The next OWASP San Antonio chapter meeting is Wednesday August 19th, 2009.  It will be held at the San Antonio Technology Center, 3463 Magic Drive, San Antonio, TX 78229 from 11:30am - 1:00pm.  The presenters are Matt Burriola and Mario Flores from Randolph-Brooks Federal Credit Union.

Topic: Web Application Firewalls (WAFs)

Abstract:
Web application firewalls (WAFs) have gained considerable momentum as web vulnerabilities have grown.  WAFs now have a proven record of reducing exposures to web vulnerabilities by blocking malicious activity much like a typical firewall.  While WAFs help, it does take time to consider when a WAF is appropriate.  It also takes time to evaluate and implement the WAF as well.  Come listen to reasons why Randolph-Brooks Federal Credit Union chose a WAF and what they learned in the process.

Presenter Bios:
Matt is a Senior Developer on the RBFCU Web Team, but mainly serves the roles of Configuration Management lead and Systems Admin for the team.  Matt maintains the source control repository, application build and release processes, and QA server environments.  Matt also works on web infrastructure initiatives such as Web Application Firewall.  Matt has 10 years IT industry experience, including Java/web technologies, C, C++, Unix/Linux, shell scripting, and Symbol mobile handheld programming.  Matt has a degree in Management Information Systems from Texas A&M University-Corpus Christi.

Mario is currently the Web Development manager for RBFCU.  In this current role, Mario manages the development efforts for the online banking site and the intranet.  Mario also has a solid background in web security and has addressed issues with web application penetration assessments.  Mario has worked for RBFCU for 14 years and he has a degree in Information Systems from Texas Lutheran University.

Sodas and snacks will be provided.  Feel free to bring a brown-bag lunch.

Please RSVP: E-mail owasprsvp@denimgroup.com  or call (210) 572-4400.

--Dan
dan _at_ denimgroup.com
@danielcornell

John Dickson's Reflections on BlackHat

By Dan Cornell

Check out this YouTube video for reflections from John Dickson on BlackHat 2009.

And don't forget to follow John on Twitter: @johnbdickson

--Dan
dan _at_ denimgroup.com
@danielcornell