OWASP Los Angeles

TOPIC: Building A Product Security Team – The Good, The Bad And The Ugly - Lessons From The Field
Join us for great networking, dinner and drinks, and see a presentation by Peter Morin, Principal, National Cyber Security Leader, Grant Thornton LLP

ABSTRACT: Ensuring that the products and services we build, and deliver are as threat resistant as possible is extremely important today. Meeting this challenge is not just about building secure applications since we all know that rapid development of software as well as the evolution of threats and vulnerabilities can see our applications as secure today but vulnerable tomorrow. That is why having an established product security team and response capability is extremely important.
During this discussion, I will discuss, using real-world examples, including that of my own, how organizations can meet the demands of product security including:

• Building a culture of security within your organization beyond firewalls and anti-virus
• How to “sell” security to executive management and explaining what product security does and doesn’t do (e.g., staffing, budgets, etc.)
• Building and deploying software using the "DevOps" approach, while maintaining a high level of security
• Difficulties of wearing multiple hats, with security being one of them
• Embedding “security” in the software development life cycle (SDLC)
• Establishing a proper security “response” program
• Product vulnerability transparency and developing a disclosure policy
• How to measure the success of your program
• Establishing a bug bounty program

Join us for our 2nd mixer with participating cybersecurity communities in Southern California, enjoy the beautiful weather, amazing sunset, great conversations, network with your peers, make new friends!
You **don'**t have to be a member of any group to participate. Mark your calendars; see you there!!

SPONSORSHIP Opportunities Available
Vendors interested in sponsoring OWASP LA events please send an email to sponsorship.la@owasp.org

TOPIC: Securing Generative AI Applications using the OWASP Top 10 for Large Language Models
Join us for dinner+drinks, networking, and see a presentation by Steve Wilson, OWASP project leader and Chief Product Officer at Exabeam

ABSTRACT: What are the new risks that generative AI brings to your environment? In this cutting-edge session, we uncover the potential hazards that Large Language Models (LLMs) introduce to modern application ecosystems. Drawing on the expertise distilled in the OWASP Top 10 for LLMs, we offer a comprehensive roadmap for mitigating these risks. Attendees will gain insights into securing generative AI applications, recognizing the nuances of LLM vulnerabilities, and deploying defenses. This talk is a call to action for developers and security professionals to foster a culture of secure, responsible AI development. Equip yourself with the knowledge to anticipate threats, apply best practices, and build AI systems that are not only intelligent but also resilient in the face of cybersecurity challenges.

TOPIC: What's in your AI code? Learn why every SCA tool is wrong, and how to deal with it.
Join us for great networking, dinner and drinks, and see a presentation by Darren Meyer, Lead Solution Architect at Endor Labs.

ABSTRACT: With the rise of AI-fueled by Python-based libraries, it has become of paramount importance to scan Python-based projects and their dependencies for OSS vulnerabilities. Python relies on package managers like pip or conda to manage declared dependencies. Dependencies are declared in manifest files which the package manager uses to install the correct version of the required dependency. However, Python’s dependency management system coupled with its dynamic type nature makes it an especially challenging language to deal with.

Of particular focus is the phenomenon of phantom dependencies which are unreported dependencies in a project's manifest profile. These hidden dependencies, which are often provided dependencies (which is especially true for libraries such as tensorflow and pytorch which are essential for AI), challenge software composition analysis (SCA) of Python code, impacting the reliability of vulnerability results.