AppSecCali 2019 Welcome Address

### Overview The AppSecCali 2019 Welcome Address opens the conference by acknowledging the collaborative efforts behind the event, which was organized by six California OWASP chapters alongside a volunteer-driven committee managing roughly 90 operational tasks. The conference chair emphasizes community involvement, the non-profit status of OWASP, and the vital role of event sponsors. The session also features brief overview presentations from diamond sponsors ShiftLeft and Netsparker prior to the morning keynote.

### Key Topics - **OWASP Organization and Governance:** OWASP operates as an open, transparent, not-for-profit entity across the US and Europe, guided by core values of openness, innovation, global reach, and integrity. The chair introduced members of the OWASP Global Board, including Martin Knobloch, Chenxi Wang, Sherif Mansoor, Owen Pendlebury, Richard Greenberg, Gary Robinson, and Ofer Maor, as well as key staff members such as acting executive director Mike McCammon, director of community and operations Matt Tesauro, community manager Dawn Aitken, and director of projects Harold Blankenship. - **Projects and Community Engagement:** The address highlighted prominent OWASP resources and standards, including the OWASP Top 10, the Application Security Verification Standard (ASVS), WebGoat, CSRF cheat sheets, and mobile application checklists among over 110 active projects. Attendees were encouraged to contribute code, start or join chapters, and facilitate dialogue between security teams, developers, and executives. - **Automated Vulnerability Discovery (ShiftLeft):** A representative from diamond sponsor ShiftLeft discussed the scaling challenges of modern vulnerability discovery. While manual penetration testing often lags behind rapid code changes, full automation cannot replace human expertise. ShiftLeft outlined their approach using a unified representation called a "code property graph" (CPG), which integrates data flows, call graphs, type hierarchies, and instruction-level information into a queryable graph structure. - **ShiftLeft Ocular Tooling:** ShiftLeft presented Ocular, an interactive REPL shell designed for analysts to query code property graphs and discover vulnerabilities. It currently supports Java, C#, and C/C++, with the C/C++ module provided as open source. - **Scaling Web Application Security (Netsparker):** Diamond sponsor Netsparker, represented by Joe, invited attendees to their upcoming talk on scaling web application security and encouraged engagement at booths 24 and 25.

### Technical Details - **Code Property Graph (CPG):** A specialized data structure merging disparate code representations—instruction-level data, data flows, type hierarchies, and call graphs—into an accessible graph search engine for custom vulnerability pattern queries. - **Ocular REPL:** A shell environment designed to query code property graphs, allowing practitioners to explore codebases and identify previously unknown security flaws.

### Takeaways - Community engagement and cross-functional collaboration between developers, security practitioners, and leadership are fundamental to advancing software security standards. - Practitioners can leverage over 110 OWASP initiatives, standards (ASVS), and tools (WebGoat) under free and open software licenses. - Vulnerability analysis must modernize beyond manual penetration testing by utilizing graph-based representations like Code Property Graphs to automate deep structural inspection while enabling human-driven query exploration.