MAD Security Code Camp recap

I got in from the Washington, DC area yesterday afternoon after a very successful Mid-Atlantic (MAD) Security Code Camp conference held on Saturday, October 29, at the Microsoft offices in Reston, VA. I don't know what the total count was (my guess between 100 and 150 people), but it was great to see so many interested in writing secure applications. I took my older boys (15 and 13) with me to try to catch some of the sights. We didn't see as much as I had hoped in the short time, but I was glad they could see me presenting/teaching again as the last time was about 6-7 years ago.

I thought my talks went well, and there lots of queat questions. I enjoyed catching up with former Boston-area friends like Aaron Weiker, as well as several others I know in the area: G. Andrew DuthieScott Allen, Darrell Norton (it was great to finally meet after all this time!), and Sahil Malik. Speaking of Andrew, he and his dedicated staff of track chairs and volunteers put on an excellent conference -- things just worked, even when there were problems, everyone reacted quickly and efficiently.

The Code Camp site has my earlier slides here, but I have also posted the latest versions on my site as well.

Update: Here is a review of Saturday (and one of my talks) by Rob Garrett. One session I regretted missing (as it was the same time as mine) was Randy Hayes' session on running and developing as non-administrator, something I have also been doing for quite some time. According to Rob's review, it looks like there is one more convert!

Published Monday, October 31, 2005 12:23 PM by RHurlbut
Filed under: , , ,

Comments

Monday, October 31, 2005 2:07 PM by Andrew Law

# Threat Tree Patterns?

Thanks very much for the great talk. Threat modeling is something I'm evangelizing as much as possible - but with very little success as many of my ISVs just don't have the resources (they don't have the resources to properly test either!)
You mentioned in your talk that the PAG folks or someone had posted some starter threat tree patterns - which would be really great as a starting point for some of my companies.
Would you happen to have a link?

Thanks very much
Monday, October 31, 2005 2:17 PM by Robert Hurlbut

# re: MAD Security Code Camp recap

Thanks for the comment, Andrew. It was great meeting another reader of my blog.

I looked in a couple of places, but rather than give links yet, let me do some follow-up work first to verify and get back to you.
Monday, November 07, 2005 8:56 AM by Darrell

# re: MAD Security Code Camp recap

Great to finally meet you Robert. Hope everything continues to go well!
Friday, June 16, 2006 10:52 AM by Robert Hurlbut's .NET Blog

# Security Development Lifecycle book and Threat Tree Patterns

I bought Michael Howard's and Steve Lipner's book The Security Development Lifecycle here at TechEd 2006...