Denim Group, Ltd.

Dan Cornell Presenting at OWASP Houston: Conducting Application Assessments

TOPIC: "Conducting Application Assessments"

SPEAKER(S): Dan Cornell, OWASP, Denim Group

ABSTRACT: This talk will review a number of application assessment techniques and discuss the types of security vulnerabilities they are best suited to identify as well as how the different approaches can be used in combination to produce more thorough and insightful results. Code review will be compared to penetration testing and the capabilities of automated tools will be compared to manual techniques. In addition, the role of threat modeling and architecture analysis will be examined. The goal is to illuminate assessment techniques that go beyond commodity point-and-click approaches to web application or code scanning.

Date: Wednesday, September 9th

Time: 6:00 - 7:30pm

Location: HCC
1010 West Sam Houston Parkway North
Spring Branch Campus Commons
Houston, TX 77043

Directions: Physically it is Beltway 8 and I-10 -- Take the Gesner Exit of I-10 from downtown. It is next door to Murphy's Deli.

Contact me for a parking pass: dan _at_ denimgroup.com / @danielcornell

Posted via web from denimgroup's posterous

Social Networking Security Slide Deck Online

By Dan Cornell

John Dickson gave a presentation on the security implications of social networking to a group of CSOs last week.  The slide deck is now online at SlideShare:

Social Networks and Security: What Your Teenager Likely Won't Tell You

View more documents from Denim Group.

John's main point is that CSOs need to approach social networking as a business issue rather than a security issue if they want to maximize their ability to influence policy and implementation.

--Dan
dan _at_ denimgroup.com
@danielcornell

Denim Group and Fortify Press Release

By Dan Cornell

We released a press release today about our use of Fortify's tools on our software development projects.  John has a video describing the release here:

Press release is here.
Business Journal coverage is here.

--Dan
dan _at_ denimgroup.com
@danielcornell

John Dickson's Reflections on BlackHat

By Dan Cornell

Check out this YouTube video for reflections from John Dickson on BlackHat 2009.

And don't forget to follow John on Twitter: @johnbdickson

--Dan
dan _at_ denimgroup.com
@danielcornell

Denim Group and WhiteHat Team Up

By Dan Cornell

We're thrilled to announce that Denim Group and WhiteHat Security have teamed up.  Denim Group will be offering WhiteHat's Sentinel web application assessment services and WhiteHat customers can work with Denim Group to integrate Sentinel into their processes and technologies as well as work with Denim Group to help remediate web application vulnerabilities.

Press release is online here.

Here is a video describing the release:

--Dan
@danielcornell

John Dickson and Sheridan Chambers at BlackHat

By Dan Cornell

John Dickson and Sheridan Chambers will be out at BlackHat this week. Follow John on Twitter @johnbdickson  Here is a video regarding some of John's plans at BlackHat:

--Dan
dan _at_ denimgroup.com
@danielcornell

Denim Group Teams with Rackspace Hosting

By Dan Cornell

I'm thrilled to announce Denim Group working with Rackspace Hosting (NYSE: RAX) customers to help them secure their applications via conducting code reviews, delivering secure software development training, and evaluating software development strategies for Rackspace clients.  We've known folks at Rackspace for years and had the opportunity to work with them in a variety of capacities so this is pretty exciting for us: BusinessWire release: Denim Group Teams with Rackspace Hosting

Whether you're hosting your applications in "the cloud" or on good old-fashioned servers, they're still targets for attack.  We're glad to have the opportunity to work with Rackspace and their clients to help reduce their risks.

John put together a brief video about the release:

This has also been picked up by a bunch of other folks:

• Yahoo Finance
• BusinessWire
• AOL Money
• Reuters
• MSN MoneyCentral

--Dan
dan _at_ denimgroup.com
Twitter: @danielcornell

John Dickson's RSA Abstract Video Online

By Dan Cornell

John Dickson's video abstract for his RSA talk on "What You Don't Know Can Hurt You: Security Professionals and Custom Apps" is now up online:

See you all in San Francisco next week!

--Dan
dan _at_ denimgroup.com

John Dickson at RSA: What You Don’t Know Can Hurt You: Security Professionals and Custom Apps

By Dan Cornell

John Dickson will be presenting at RSA this year about "What You Don’t Know Can Hurt You: Security Professionals and Custom Apps"  The abstract for the talk is:

Security managers rarely have software backgrounds. However, they get the blame when unsecure software is exploited and a breach occurs. This session will help security managers better characterize different software development approaches and identify risks associated with building custom applications. Software assessment strategies and secure SDLC improvements will be discussed in depth.

The session is PROF-402 and the talk is scheduled for:

Friday, April 24 10:10 AM Purple 3

More info can be found on the RSA 2009 conference website.  Also - follow John on Twitter @johnbdickson for updates about RSA and more.

--Dan
dan _at_ denimgroup.com

OWASP Houston Next Week (POSTPONED)

By Dan Cornell

CORRECTION: My talk to OWASP Houston has been delayed so I will NOT be speaking to the April 8th meeting.  I will make it to OWASP Houston within the next month or so - sorry for any confusion.

Original Post:

I will be speaking about Vulnerability Management in an Application Security World at the Houston OWASP meeting next Wednesday.  John Dickson will also be there.  The meeting is Wednesday April 8th and, as always, is free to all.

Time:
6:00-6:15 Welcome and Announcements
6:15-7:30 Presentation

Location:
Microsoft Campus
One Briar Lake Plaza
2000 W. Sam Houston Pkwy. S. #350
Houston, TX 77042
Phone: (832) 252-4300

--Dan
dan _at_ denimgroup.com