1. OWASP Cambridge 2 nd December 2014

2. Agenda Networking, food and refreshments Welcome Colin Watson Global Application Security Survey & Benchmarking John Smith Anatomy of a Data Breach Joe Pelletier OWASP Roundup Colin Watson Networking

3. OWASP Roundup Past conferences Project updates AppSec EU 2015 Supporters Close

4. Past AppSec Conferences AppSec EU 2014 23-26 June, Cambridge UK https://2014.appsec.eu/ https://www.youtube.com/playlist?list=PLpr-xdpM8wG_KHsxepT9o6trkqDELhr3_ AppSec USA 2014 16-19 September, Denver USA http://2014.appsecusa.org/2014/ http://2014.appsecusa.org/2014/about/live-streaming/ https://www.youtube.com/playlist?list=PLpr-xdpM8wG8jz9QpzQeLeB0914Ysq-Cl

5. Testing Guide Version 4 17 th September 2014 https://www.owasp.org/index.php/OWASP_Te sting_Project

6. Proactive Controls Version 1 10 th March 2014 https://www.owasp.org/index.php/OWASP_Pr oactive_Controls

7. AppSensor Website 11 th September 2014 http://www.appsensor.org/ Reference implementation 13 th September 2014 v2.0.0 beta https://github.com/jtmelton/appsensor/release s/tag/v2.0.0-beta

8. Dependency Checker Version 1.2.6 17 th November 2014 http://jeremylong.github.io/DependencyChec k/

9. Web Goat Version 6.0 12 th September 2014 http://webgoat.github.io/

10. Cyber Security Week OWASP London Cyber Security Week Workshops, talks and hackathon Startup focus Free to all Held at Google and UCL 26-30 January 2015

11. AppSec EU 2015 Envisioned program 4 applied talk tracks: Builder, Breaker, Defender, CISO 1 research track 19-22 May 2015 Amsterdam RAI The Netherlands

12. London Chapter Supporters

13. Thank You Speakers John Smith Joe Pelletier Chapter Leaders Justin Clarke Tobias Gondrom Hosts for this evening Skype Attendees

14. OWASP Volunteers Project leaders Project contributors Chapter leaders Members Corporate supporters Individual members Other supporters

15. Corporate Sponsors

16. Something Different Top Ten Risks 1.Injection 2.Broken Authentication and Session Management 3.Cross-Site Scripting (XSS) 4.Insecure Direct Object References 5.Security Misconfiguration 6.Sensitive Data Exposure 7.Missing Function Level Access Control 8.Cross-Site Request Forgery (CSRF) 9.Using Components with Known Vulnerabilities 10.Unvalidated Redirects and Forwards Top Ten Proactive Controls 1.Parameterize Queries 2.Encode Data 3.Validate All Inputs 4.Implement Appropriate Access Controls 5.Establish Identity and Authentication Controls 6.Protect Data and Privacy 7.Implement Logging, Error Handling and Intrusion Detection 8.Leverage Security Features of Frameworks and Security Libraries 9.Include Security-Specific Requirements 10.Design and Architect Security In

17. Another Game

18. Snakes and Ladders

19. Mobile Apps Too

20. Print Your Own Adobe PDF A2 print quality Adobe Illustrator Source Web Applications DE, EN, ES, FR, JA, ZH Mobile Apps EN, JA

21. Staying in Touch Chapter page https://www.owasp.org/index.php/London Mailing list http://lists.owasp.org/mailman/listinfo/owasp-london TwitterFacebook http://twitter.com/owasplondonhttps://www.facebook.com/OWASPLondon Elsewhere in the UK Birmingham, Bristol, Cambridge, East Midlands, Leeds, Manchester, Newcastle, Royal Holloway, Scotland, South Wales, Suffolk

22. The Melton Mowbray 18 Holborn