Security/Meetings/SecurityAssurance/2013-06-18

« previous week | index | next week »

• Time: (Weekly) Tuesday at 13:30 PM PDT / 16:30 PM EDT / 21:30 PM UTC.
• Place: Mozilla HQ, 3A-All Your Base (3rd Floor)
• Phone (US/Intl): 650 903 0800 x92 Conf: 95316#
• Phone (Toronto): 416 848 3114 x92 Conf: 95316#
• Phone (US): 800 707 2533 (pin 369) Conf: 95316#

Agenda

• Vendor Review proposal
  • need a way to gauge vendor reviews, what should / must be done
  • used the current list of questions as the guide
  • this is a Q2 Goal for Curtisk - please provide any feedback by EoD 21-June
  • G Doc
• Documentation expectations for security reviews of web apps & services
  • Higher-risk projects have higher documentation requirements
  • Risk Ratings for Security Reviews
  • https://wiki.mozilla.org/Security/RiskRatings#What_Scores_Mean
  • https://wiki.mozilla.org/Security/ReviewProcess
  • OpSec review part coming soon
• Black Hat & DEF CON & CodenomiCON
  • Milk & Cookies party
• Sec Engineering team meetup this week.
  • MV (The Bridge) Mon-Wed
  • SF Thur
• Summit location stuff - no update
• Goals - Please keep status up to date - https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0AmLct3lOMM6ZdHU3a2lJRV8xckZXclZJdkNlN3dUYVE&usp=sharing
• Metrics
  • https://security-review-statistics.vcap.mozillalabs.com/
  • https://people.mozilla.com/~sarentz/p/dashboard
    • you can check your stale bugs here ^
    • 23 Kickoff bugs blocked by Security Reviews https://people.mozilla.com/~sarentz/p/dashboard/#!/kickoff

Demos

   Minion Status Update + Quick Demo [st3fan]

Upcoming Speaking Engagements

(List it at these two locations too: https://developer.mozilla.org/en-US/events & https://wiki.mozilla.org/Security/Talks )

• psiinon: June 20 OWASP EU tour, Amsterdam - ZAP
• freddyb: June 21: Hack in Paris, June 19-21: "Origin Policy Enforcement in Modern Browsers"
• mgoodwin: June 26 OWASP EU Tour, Dublin - Your Browser as a Security Tool
• psiinon & freddy: August 20-23 AppSec EU - ZAP (see above)
• psiinon: November 18-21 AppSec USA - ZAP
• stefan: "Web Security 101" & "Firefox OS" at OHM213, July31 - August 4
• yvan: RMLL July 7-11, Talking about Security

Planned Blog Posts

• https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0AlDw2hHXmVgCdHN3LWZTZ0hjMElPc1g2clRKb2lNN3c
  • https://mana.mozilla.org/wiki/display/~sbennetts@mozilla.com/Draft+blog+post%3A+How+to+speed+up+OWASP+ZAP+scans « psinnon

Security Review Status (curtisk)

• Completed in Q1 2013: 66

https://security-review-statistics.vcap.mozillalabs.com/weekly (currently at 60, on track to meet or exceed Q1)

Project Updates

Please add your name to the update so we know who to follow up with

Firefox OS

• [cr] From the Making The Same Mistakes Over And Over Again Departmend: iOS screwed up password creation for tethering http://translate.google.com/translate?hl=en&sl=de&u=http://www.heise.de/newsticker/meldung/iOS-Sicherheitsmaengel-im-Persoenlichen-Hotspot-1891356.html&prev=/search%3Fq%3Dhttp://www.heise.de/newsticker/meldung/iOS-Sicherheitsmaengel-im-Persoenlichen-Hotspot-1891356.html%26client%3Dfirefox-nightly%26hs%3DOl4%26rls%3Dorg.mozilla:en-US:unofficial

• • We implemented the same password generator and actually found that it was a good balance between actual risk and user convenience :-)
  • (Seriously?) How would you figure that balance? WPA cracking can be done offline on a couple of sniffed packets by a GPU, so a complexity of 2^20 is not sufficient. Now the point-and-click cracking tools are there to prove it.