You are viewing details from a past event. Please check our upcoming event schedule if you are looking for current content.

Steve Kosten

Steve Kosten

Security Consultant @ Cypress Data Defense

Steve Kosten is a security consultant at Cypress Data Defense and an instructor for the SANS DEV541 Secure Coding in Java/JEE: Developing Defensible Applications course. He's previously performed security work in the defense and financial sectors and headed up the security department for a financial services firm. He is currently the Open Web Application Security Project (OWASP) Denver chapter leader and is on the board for the OWASP AppSec USA conference. He has presented security talks before numerous conferences. He is experienced in secure code review, vulnerability assessment, penetration testing, risk management. He holds a bachelor of science in Aerospace Engineering from the Pennsylvania State University and a Master of Science in Information Security from James Madison University. He currently maintains GSSP-JAVA, GWAPT, CISSP, and CISM certifications. Steve resides in Golden, Colorado. In his spare time, Steve enjoys attending his childrens' sporting events with his wife, road and mountain biking, snowboarding, golfing, volleyball, and paragliding.

Presentations

Integrated Vulnerability Scanning with ZAP

11:00 AM MDT

The Agile and DevOps software development lifecycles present interesting challenges for application security. How can security keep up with the rapid development cycles, constantly changing code base, and continuous deployment schedules? The answer lies within an automated security framework that is integrated into the development lifecycle.

This presentation will demonstrate how to integrate a new application security testing framework into your build environment. Popular open-source vulnerability scanners, such as the Zed Attack Proxy (ZAP), will be leveraged to provide real-time feedback to development teams, allowing them to remediate vulnerabilities before they reach production.

Exploiting Common Web Application Vulnerabilities

1:30 PM MDT

Exposing applications over the web continues to allow attackers to compromise an organization’s clients, customers and employees. These applications are often deployed with compressed development timelines, and as a result often contain several common security vulnerabilities. This presentation will discuss and demonstrate exploitations of the most common vulnerabilities identified during a security review, using tools such as Burp Suite, BeEF, and sqlmap. Most importantly this presentation will also demonstrate how to remediate and eliminate these vulnerabilities from your applications.

In this presentation, we will be discussing the following vulnerabilities from the OWASP Top 10:

A1: Injection
A3: Cross-Site Scripting (XSS)
A8: Cross-Site Request Forgery (CSRF)