Export to

• Google Calendar
• iCalendar file
• hCalendar markup
  <div class="vevent h-event"> <h1 class="summary p-name">ISSA February Luncheon meeting</h1> <div class='date'><time class="dtstart dt-start" title="2014-02-20T11:30:00" datetime="2014-02-20T11:30:00">Thursday, February 20, 2014 from 11:30am</time>–<time class="dtend dt-end" title="2014-02-20T13:00:00" datetime="2014-02-20T13:00:00">1pm</time></div> <div class="location vcard p-location h-card"> <a class="url" href='http://calagator.org/venues/202392943'><span class='fn org p-name'>Con-Way</span></a> <div class="adr p-adr h-adr"> <div class="street-address p-street-address">2055 NW Savier St</div> <span class="locality p-locality">Portland</span> , <span class="region p-region">OR</span> <span class="postal-code p-postal-code">97209</span> <div class="country-name p-country-name">US</div> (<a href='https://maps.google.com/maps?q=2055%20NW%20Savier%20St,%20Portland%20OR%2097209%20US'>map</a>) </div> </div> <div class="description p-description"> <p>Presentation: Pitfalls of Web Session Management</p> <p>Login session management in modern web applications is largely applications dominated by use of HTTP cookies. However, HTTP cookies were never designed for secure applications, which has led to a significant number of protocol security problems. In this talk, the speaker will start with a brief background on why HTTP cookies are a poorly-conceived mechanism to begin with, and continue with a discussion of how this impacts security. He will describe several lesser-known cookie-based session management problems that remain wide spread and allow for session hijacking through a variety of clever attacks.</p> <p>Who: <br> Timothy D. Morgan<br> Principal Security Consultant - Blindspot Security LLC<br> As an application security consultant and vulnerability researcher, Tim has been taking deep technical dives in security for over a decade. In that time, he has been credited with the discovery and responsible disclosure of numerous security vulnerabilities in a variety of software products, including: IBM Tivoli Access Manager, Sun Java Runtime Environment, Google Chrome Web Browser, OpenOffice, Oracle WebLogic Application Server, and IBM Websphere Commerce. His current research interests include applied cryptanalysis, IPv6 security and XML external entities attacks. Tim develops and maintains several open source forensics tools in addition to Bletchley, an application cryptanalysis toolkit.</p> <p>Tim works to secure his customers' environments through black box testing, code reviews, social engineering evaluations, security training and a variety of other services. Tim earned his computer science degrees from Harvey Mudd College and Northeastern University and currently resides in Portland Oregon where he leads the local OWASP chapter</p> <p>Cost: $10 (member) / $15 (non-member) / $2 (at-the-door)</p> <p>CPEs: The ISSA meetings are appropriate for CPE credit. The chapter maintains proof of attendance for members but it is the members responsibility to ensure that these CPE's are credited to their respective accounts.</p> </div> <h3>Links</h3> <ul> <li><a class="url u-url" href="http://www.eventbrite.com/e/february-lunch-program-pitfalls-of-web-session-management-tickets-8163777077">Website</a></li> </ul> </div>