So I’m working with the AppSecDC folks doing press relations amongst other things.  I’ve noticed several themes for the conference that might be of interest to the rest of the world.  Of course there’s the usual “The end is nigh, and not even Norton can save you!!!!!” stuff that’s been the staple of security conferences for the past 5 years or so (oh noes, teh Internetz are broken.  Again)

However, AppSecDC has another set of themes that are mostly unique to OWASP and AppSecDC in particular:

• The OWASP Approach to Security: it’s not process/product, it’s education and outreach.  Thanks to Doug Wilson for this idea.  Basically with host and network security, the option is to buy stuff and throw it at the problem.  With application security, it’s “go out and touch a developer today” and “use ESAPI as a tool to help the developers write better and secure code more quickly”.  This is a new concept to the system integrator that I am, but I like it much better than my usual approach.
• Government and Application Security: we’re about 5 years behind industry, how do we catch up?  To this effort, we have some notable Government speakers such as a keynote by Joe Jarzombek, Director for Software Assurance in the National Cyber Security Division of the U.S. Department of Homeland Security.
• OWASP Top 10 2009/2010: This will be announced at AppSecDC with much w00tness and excitement.
• OWASP National Summit: this will be held the day before the official conference.

Convinced you want to go?  Check out the conference site.

• OWASP AppSec Conference 09
• Ed Bellis’s Little SCAP Project
• Analyzing Fortify’s Plan to “Fix” the Government’s Security Problem
• SP 800-53A Now Finally Final
• Next Up in Security Legislation: S3474

It’s a global-scale conference. It’s in DC November 10-13th.  Registration is open.  I’m helping out as manual labor and maybe all-around fluffer of some sort.

The DC area sponsors (contractor companies and non-profits) are noticeably lacking, and I would like to fix that.  If you’re interesting in sponsoring, let me know and I’ll forward your info on to the event organizers.

And while I’m out shilling, the DC OWASP Chapter is going strong and having their next meeting on August 5th.  Check them out.

• Privacy Camp DC–April 17th
• I’m on the OWASP Podcast
• AppSec DC Press and Themes
• On Government Employees, Culture, and Survivability
• Evolving the Physical Hacking at Security Conferences