up vote 12 down vote favorite

We received an email from the OWASP conference inviting us to sponsor them again, this time for their Austin, TX conference in October.

As far as industry events go, we're pretty sure this is a good one to be affiliated with. However, in the interests of transparency, we'd like to know: should we sponsor OWASP again? If so, why?

share
One point to note seperately, while I am of course strongly in favor of the sponsorship this year as in last, the other question is - sponsoring which chapter/project? Up to 40% of the sponsorship can be allocated to a specific one - or two, as we did last year. I think the idea of choosing a chapter/conference, and seperately a (open source) project to sponsor as part of the corporate sponsorship, is simply brilliant. – AviD♦ Jun 19 '12 at 9:03

3 Answers

up vote 19 down vote

@AviD will probably have a better in depth answer, but mine would be simply:

They are an independent, not for profit organisation which aims to provide free tools for all web developers to help secure their code, applications and environments and this benefits us all.

They are high profile, and the OWASP Top Ten has been accepted by most of the Fortune 500 as the de facto minimum requirements for securing their externally facing web sites. In addition ESAPI, the Enterprise Security API makes it easier for coders to write lower risk applications by providing a security control library.

Good recipient of sponsorship, I say - wide audience, deserving cause, high profile, will benefit SE's members directly.

share
3  
I think Rory hit the nail on the head, so much so I've resigned to not bothering trying to write my own answer! Fortune 500 looking to a community driven not for profit organization for guidance? Win! – chao-mu Jun 15 '12 at 13:46
1  
Absolutely agree, not much for me to add. As I said last time around, OWASP's mission is very much in line with SEI's mission: Making the Internet smarter / securer (sic). This is on two levels: local community chapters + regional conferences, spreading knowledge by lectures and such; and the very practical projects (both software and guidance) that they put out, ESAPI is one of them as @Rory noted. – AviD♦ Jun 19 '12 at 8:50
up vote 8 down vote

So I saw a mention from the DMZ about me and this, so I'll chip in.

I guess the answer partially depends on why StackExchange do sponsorships...

I'd guess that one reason is to help boost awareness of the SE network and specifically Sec.SE. In this case then I'd say that sponsoring OWASP events in general should be a good option.

OWASP events tend to be primarily attended by people on the technical side of application security (both security practitioners and developers). I'd say that the attendees are a good match for the kind of people we'd like to see contributing here, so raising awareness of Sec.SE with OWASP attendees would be good from that point of view.

There's also the aspect that @RoryAlsop raised, which is that OWASP are a non-profit security organisation who depend on sponsorships and memberships to raise funds for projects and conferences.

Quite a few of their projects are well referenced and used in the security community in general (the OWASP Top 10 in particular) and get quite a few references on Sec.SE (210 from a basic search), so hopefully helping to fund them through sponsorships helps to improve the overall state of the AppSec industry...

Is that helpful?

share
up vote 2 down vote

My answer is why not? Disclaimer: maybe my opinion would a little bit bias, since I active at OWASP and I am OWASP Indonesia Chapter Leader.

OWASP open all of their resources. The documentation projects and tools projects. Even their mailing list archive. With this openness, it's really helpful for me to find web application security materials. If yesterday, people tend to do security by obscurity, in OWASP their not.

I was attended the last OWASP summit, which was held last year at Lisboa, Portugal. It was really great to meet people who share the same passion at web application security.

share

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged