SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Automation Domination: Enhancing Application Security with Continuous Integration

jason avatar
jason
22 diapositives · 320 Views · Jul 10, 2014

Lead Application Security Engineer shares insights on Security Development Lifecycle (SDL) and automation benefits, including dynamic and static scanners. Learn strategies to improve application security effectively. Hosted by OWASP & the NYC Chapter.

#automation domination: enhancing application security with continuous integration #automation domination: enhancing application security with continuous integration ppt #powerpoint #presentation
Automation Domination: Enhancing Application Security with Continuous Integration - slide 1
01 / 22Automation Domination: Enhancing Application Security with Continuous Integration
1 / 17

Télécharger la présentation

Automation Domination: Enhancing Application Security with Continuous Integration
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Automation Domination Application Security with Continuous Integration (CI)

  2. About Me • Lead Application Security Engineer for Morningstar formerly with CME Group Over 8 years of leading and participating in all aspects of the Security Development Lifecycle (SDL), including developing, deploying, supporting enterprise static (SAST) and dynamic scanners (DAST). Hosted by OWASP & the NYC Chapter

  3. Agenda • Why bother • Zero-sum game for application security • Where to start? • Tipping the scales in our direction • Making it work for you! • Demo Hosted by OWASP & the NYC Chapter

  4. Automation Domination Should I pay attention? • Are you a current, future, or past Dynamic and/or Static Scanner users? • Are you looking to implement a Security Development Lifecycle (SDL) or Software Development Lifecycle (SDLC) ? • Interested in saving time and money to deliver software? • Is management bugging you about metrics?

  5. Automation Domination Mission Develop an application security automation program to assist software development teams with iterative application security testing. Hosted by OWASP & the NYC Chapter

  6. Automation Domination • Hundreds to thousands of developers • Too many applications with systemic issues Are we outnumbered? Hosted by OWASP & the NYC Chapter

  7. Automation Domination Capability Maturity Model Unpredictable Reactive Development Methodology Measured & Controlled Focus is on improvement Hosted by OWASP & the NYC Chapter

  8. Automation Domination Software development maturity • Development • Architecture/Design Documents • Build Process & Deployment • Bug-Tracking • Architecture/Design • Data-flow diagrams (DFDs) • Charters and/or Project Plans Hosted by OWASP & the NYC Chapter

  9. Automation Domination • Findings • Taxonomy of Findings/Vulnerabilities (CWE) • Risk Scoring (CVSS) • Anatomy of Findings/Vulnerabilities (Issue Type) • Scanning • Scope your DAST & SAST findings to Development • Define a process from finding-to-fix Normalize your scans & findings

  10. Automation Domination OWASP has the technology!

  11. Automation Domination Topics for Requirements • Authentication • Session Management • Authorization • Input Validation • Output Encoding • Client Side Security • Sensitive Data Handling • Data Protection (Data in Transit & Rest) • Supplemental Specifications for Testing Hosted by OWASP & the NYC Chapter

  12. Automation Domination ThreadFix (Security Requirements)

  13. Automation Domination Network Topology Hosted by OWASP & the NYC Chapter

  14. Automation Domination Working the flow Hosted by OWASP & the NYC Chapter

  15. Automation Domination ThreadFix Configuration

  16. Automation Domination Automated Static Analysis

  17. Automation Domination Bug Submission

  18. Automation Domination Now for a change of pace!

  19. Automation Domination Static & Dynamic Scanning w/ Bamboo

  20. Automation Domination Static & Dynamic Scanning w/ Bamboo

  21. Automation Domination Dynamic Scan in CI with Agent

  22. Automation Domination http://github.com/automationdomination Thank you! brandon@automationdomination.me