<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Sprechblasentext Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US>HACKPRA TALK: JEREMIAH GROSSMAN<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>*<b>Horst Görtz Institute for IT-Security, Ruhr-University Bochum, Building ID, Room 04/459</b>*<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>*<b>July 3, 2013 at 4pm</b>* <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>Jeremiah Grossman, founder and chief technology officer of WhiteHat Security, is a world-renowned expert in web application security and a founding member of the Web Application Security Consortium (WASC). He is a frequent speaker at industry events including the BlackHat Briefings, ISACA's Networks Security Conference, NASA, ISSA and Defcon. The Horst Görtz Institute for IT-Security proudly presents his talk during HackPra on July 3, 2013 at 4pm.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>*<b>Abstract:</b>*<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>What’s needed is more secure software, NOT more security software.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Understanding this subtle distinction is key. Organizations must demand that software be designed in a way that makes it resilient against attack and does not require additional security products to protect it.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>The question that organizations should be asking themselves is: how do we integrate security throughout the software development life-cycle (SDLC)?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>As simple as these questions sound, the answers have proven elusive.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Most responses by the so- called experts are based purely on personal anecdote and devoid of any statistically compelling evidence. Many of these experts will cite various “best- practices,” such as software security training for developers, security testing during QA, static code analysis, centralized controls, Web Application Firewalls, penetration-testing, and more; The reality, though, is that just because a certain practice works well for one organization does not mean it will work at another. Unfortunately, this hasn’t prevented many from boisterously and carelessly advocating a litany of best-practices with little regard for true efficacy and important operational considerations.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The net result: websites no less hackable today than they were yesterday. To move in this direction we asked WhiteHat Security customers to assist us by answering roughly a dozen very specific survey questions about their SDLC and application security program. Questions such as: how often do you perform security tests on your code during QA?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>What is your typical rate of production code change? Do you perform static code analysis? Have you deployed a Web Application Firewall? Who in your organization is accountable in the event of a breach? </span>We even<o:p></o:p></p><p class=MsoNormal>asked: has your website been breached?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US>We received responses to this survey from 76 organizations, and then correlated those responses with WhiteHat Sentinel website vulnerability data. The results were both stunning and deeply head scratching. The connections from various software security controls and SDLC behaviors to vulnerability outcomes and breaches is far more complicated than we ever imagined.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>The G Data Software AG offers an evening program, accompanying the "HackPra" at the Horst Görtz Institute for IT-Security. Every participant is welcome to meet the speakers and the "HackPra's" organizing crew in the G Data Academy. Further information on G Data and the HackPra can be found here: <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><a href="http://www.nds.ruhr-uni-bochum.de/teaching/hackpra/">http://www.nds.ruhr-uni-bochum.de/teaching/hackpra/</a><o:p></o:p></span></p><p class=MsoNormal><a href="https://www.gdata.de/offensive-security-course"><span lang=EN-US>https://www.gdata.de/offensive-security-course</span></a><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>*<b>Participation is free of charge</b>*<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p></div></body></html>