owasp and csa_tisa pro-talk_4-2554

© 2011 TISA All Rights Reserved

คร ัง้ที ่4 /2554

จดัโดย

Thailand Information Security Association (TISA)

สมาคมความมั่นคงปลอดภยัระบบสารสนเทศแห่งประเทศไทย


Agenda


TISA MC


What is OWASP?


OWASP Local Chapter around the world


https://www.owasp.org/index.php/Thailand

OWASP Thailand Chapter





How to Participate




OWASP Thailand Chapter Facebook Fan page


OWASP Top 10 Risks

https://www.owasp.org/index.php/Top_10_2010







Web Application Risks

Outer

Inner

DMZ Zone

Server farm Zone

© 2011 TISA All Rights Reserved O

ute

r Fire

wall

Hardened OS

Web Server

App Server

Inn

er F

irew

all

Da

tab

as

es

Le

ga

cy S

ys

tem

s

We

b S

erv

ice

s

Dir

ec

tori

es

Hu

ma

n R

es

ou

rce

Bil

lin

g

Custom Developed

Application Code

APPLICATION ATTACK

You can’t use network layer protection (Firewall, SSL, IDS, hardening) to stop or detect application layer attacks

Netw

ork

Layer

Ap

pli

ca

tio

n L

aye

r Your security “perimeter” has huge

holes at the “Application layer”

Your “Code” is Part of Your Security Perimeter


https://lists.owasp.org/mailman/listinfo/owasp-thailand

OWASP Thailand Mailing-list





Cloud Security Alliance (CSA)

Thailand Chapter

Thanasin Jitkaew (TISA Volunteer) SSCP, (IRCA:ISMS), C|EH, CCNA, Network+

PTT ICT Solutions Co.,Ltd.


What is Cloud Security Alliance (CSA)?

- Established in December 2008

- Not-for-profit organization (member-driven)

- With a mission to

o Promote the use of best practices for providing security assurance within Cloud Computing.

o Provide education on the uses of Cloud Computing to help secure all other forms of computing.

Source: https://cloudsecurityalliance.org/about/

https://cloudsecurityalliance.org/about/




Membership

- Individuals

- Chapters

- Affiliates

- Corporations

Source: https://cloudsecurityalliance.org/membership/

Who are members of the CSA?

https://cloudsecurityalliance.org/membership/




Research

- Security Guidance for Critical Areas of Focus in Cloud Computing ( >100k downloads)

Source: https://cloudsecurityalliance.org/research/

What does the CSA offer?

https://cloudsecurityalliance.org/research/






Research

- Cloud Control Matrix (CCM) o Controls derived from guidance

o Mapped to familiar frameworks:

ISO27001, COBIT, PCI , HIPAA, FISMA, FedRAMP

o Customers vs. Provider role

o Help bridge the “cloud gap” for IT & IT auditors











Research

- Security Guidance for Critical Areas of Focus in Cloud Computing








Research

- Security Guidance for Critical Areas of Focus in Cloud Computing

- Cloud Control Matrix (CCM)

- Top threats to Cloud Computing

- Consensus Assessment Initiative

- Trusted Cloud Initiative

- Cloud Security Alliance GRC Strack

- …







Regional chapters are essential to the mission of CSA Global to promote the secure adoption of cloud computing.

CSA Regional Chapters

17 chapters 36 chapters


Near by?

- Official GuangZhou Chapter, Singapore Chapter

- In Development Hong Kong Chapter, Taipei Chapter, Indonesia Chapter

CSA Regional Chapters

Thailand?


CSA & OWASP Thailand Chapter Meeting (1/2011)


Getting Started

Apply for your CSA chapter as follows:

1. Define your chapter’s geographical boundary.

2. Sign up a minimum of 20 members based within the geography. Provide member’s name, email address and LinkedIn URL. If a LinkedIn URL is not available, contact CSA Global for an alternative.

3. Select a board of directors from within the initial members based upon a consensus process developed by the members.

4. Select a chapter name with the format Cloud Security Alliance, XXXX Chapter.

5. Send the above application to [email protected]

Source: https://cloudsecurityalliance.org/CSA-Chapter-Launch-Guide.pdf

Becoming a chapter

https://cloudsecurityalliance.org/CSA-Chapter-Launch-Guide.pdf









https://www.facebook.com/pages/TISA/161554843888938 หรือ

TISA Facebook Fan page

มาเป็นแฟนกนันะ

วธีิการเข้าหรือค้นหา TISA Fan page :

https://www.facebook.com/pages/TISA/161554843888938



owasp and csa_tisa pro-talk_4-2554

Technology