2. “Security is a process, not a product” -- Bruce Schneier

3. What if the software world was only… 100 apps written by 100 developers at 100 companies

14. Why?

16. “Don’t hate the playa Hate the game” -- Ice T

18. We Trust We Blame We Hide Toxic?

19. AppSec Visibility Cycle Audit Developers Infosec Legal Architects Users Research Business Monitor Threat Create Security Architecture Define Security Requirements Implement Controls Share Findings Understand Laws Verify Compliance Understand Stakeholders Our Mission: Visibility

20. Growing Ecosystems

21. OWASP Foundation (OWASP Board) Projects Membership Education Conferences Industry Chapters Connections OWASP Leaders (Chapters and Project) OWASP Meritocracy OWASP MembersOWASP Users and Participants

22. DC Sep 2009 Nov 2010 DC Sep 2009 Nov 2010 Brussels May 2008 Brussels May 2008 Poland May 2009 Poland May 2009 Taiwan Oct 07-08 Taiwan Oct 07-08 Portugal Nov 2008 Portugal Nov 2008 Israel Sep 07-08 Israel Sep 07-08 India Aug 2008 Nov 2009 India Aug 2008 Nov 2009 Australia Feb 08-09 Australia Feb 08-09 Minnesota Oct 08-11 Minnesota Oct 08-11 Denver Spring 08-10 Denver Spring 08-10 Sweden June 2010 Sweden June 2010 Ireland Sept 08-09 June 2011 Ireland Sept 08-09 June 2011 Greece June 2012 Greece June 2012 New York Nov 2008 Oct 2012 New York Nov 2008 Oct 2012 China Oct 2010 China Oct 2010 New Zealand July 09-10 New Zealand July 09-10 Brazil Oct 09-10 Brazil Oct 09-10 Germany Oct 08-10 Germany Oct 08-10

23. Today Getting Started with OWASP T10 and Guides Building a Software Assurance Program Using the OWASP Live CD =====LUNCH===== OWASP Enterprise Security API (ESAPI) OWASP O2 The DISA AppSec STIG and OWASP Tools Discussion