2013.02.22 CAS AppSec Working Group Call
CAS AppSec Working Group Call
Meeting Details
Friday, February 22, 2013. 13:00 - 14:00 ET
Call in Number: http://www.calliflower.com/2011/11/15/international-conference-calling/
Conference Code: 4397017
Participants
@Jérôme LELEU
@Parker Neff (Deactivated)
@David Ohsie
@Andrew Petro
@William G. Thompson, Jr.
@Joachim Fritschi
Agenda
Introductions
Review/Approve Meeting Minutes
Review Action Items
Open Discussion
Meeting Schedule
Share sample security artifacts
Next Steps
Meeting Notes
After brief introductions the previous meeting minutes were reviewed and approved.
Potential Tools list started and discussed.
Discussed the potential need for separate public and private mailing list for the working group. For now continue use cas-dev for public communication, and look into setting up a private list for vulnerability discussions.
Consider adopting OWASP model (Builders, Breakers, Defenders) to help organize and prioritize various work activities.
Refine WG scope and objectives via draft charter.
Meetings to be scheduled bi-weekly preferably not on Fridays.
With the OWASP model in mind, where should the group focus our efforts first?
Action Items
List potential tools for use in a security assessment on WG home page - Team
Reach out to potential tool vendors regarding licenses for open source projects - Bill
Sketch out CAS security assessment - Team
Establish liaison with Jasig Security Contact Group - Andrew
Draft WG charter - Andrew
Draft inventory of 3rd party vs custom code - Jérôme
Draft example security artifacts (data flow diagram, etc) - David
Investigate private mailing list/wiki for CAS AppSec WG - Bill
Poll for conf call tools http://doodle.com/f3pm3iuqgfd9fzvb - Bill
Poll for conf call time http://doodle.com/knfdm66cenhkxveq - Bill