Robots with Pentest Recipes:
|
|
- Emery Russell
- 6 years ago
- Views:
Transcription
1 Robots with Pentest Recipes: Democratizing Security Testing for DevOps Wins Abhay Bhargav - CTO, we45
2 Yours Truly Co-author of Secure Java For Web Application Development Author of PCI Compliance: A Definitive Guide Speaker at OWASP Conferences worldwide Chief Architect of Orchestron Avid Pythonista and AppSec Automation Junkie Specialization in Web Application Security and Security Testing Lead Trainer - DevSecOps Workshop
3 Today's Session A Different Side of DevSecOps => Some Key Challenges Introducing the Robot Framework AppSec Testing Recipes with Robots Case Studies
4 Security in DevOps Code Test Deploy Monitor Plan Build Release Operate Threat modeling SAST Security - Composition DAST IAST Security in IaC Security monitoring & attack detection
5 The Need of the Hour. To Find and Fix Security Bugs early and often Security to integrate with your Agile Development Security to seamlessly work with your Continuous Delivery Pipeline
6 Let s get real for a minute
7 We re still running into some serious issues
8 Application Security is overwhelmed CI/CD Pipeline Security Reviews Bug Bounties Threat Modeling Security Assessments to name a few.
9 Automating AppSec - Challenging Multiple SAST and DAST Tools Their OWN API - Complexities Running them in a purely automated workflow gets complex Custom Security Flaws - Hard to weave into a fabric
10 We need to continuously test for security?
11 In Short.
12 What do we need?
13 Engineering - Run Security Locally Engineering - Run Localized Security Engagement with Security Teams - For High Value Added Requirements Make Security a First Class Citizen
14 More Effective Pentest Efforts Have your Pentest Teams work on finding more complex vulnerabilities Get them to script out complex pentest findings into Security Regression Scripts Get them involved in AppSec Automation
15 Get QA/QE Involved Quality Engineering - Usually develops a great deal of Test Automation Would be great to leverage their Test Automation For Security Testing Would be EVEN better to give them a single fabric for both Test Automation and Security Testing
16 Single Fabric => Test Automation + Security Testing Create Test Suites that combine capabilities of Software Test Automation and Security Testing tools Run a combination of tools - to provide coverage across different abstractions Use Pentest Results as Security Regressions Basically, create repeatable and reproducible recipes that work for your product
17 Enter, Robot Framework
18 What is Robot Framework Generic Test Automation Framework - Acceptance Testing and Acceptance Test Driven Development Extend Libraries in Python and Java Modular Architecture
19 Single Slide Introduction to ATDD
20 How it works When the test starts, Framework parses Test Data Utilizes Keywords from Test Libraries to interact with system being tested Libraries can communicate with the system either directly or using other test tools as drivers Reports generated as HTML and XML
21 Why we like it? Flexible Natural Language Syntax - FTW! Easy to develop API for Tools Modular Comes with Reporting out of the Box Python and Java Support
22 Natural Language Syntax *** Test Cases *** Login to Healthcare App [Tags] login input text _id input password password cwasp click button id=submit set browser implicit wait 10 location should be ${BASE_URL}dashboard/
23 Popular Third Party Libraries - Robot Framework Android and ios Automation - Calabash Selenium Appium Python Requests Diff Library SSH
24 Security Tool Libraries - Robot Framework Robot Framework - OWASP ZAP Integration => RoboZAP Robot Framework - Nmap Integration => RoboNmap Robot Framework - BurpSuite Integration => Robo2Burp Robot Framework - Sublist3r Integration Robot Framework OWASP Dependency Check Robot Framework - Arachni Integration
25 Adapting it for security Empowering Engineering Teams to Run their own Security Testing Engaging Functional Test Automation Teams to contribute to security Combining Functional Testing as an Input to DAST Tools Lowering the Entry Barrier for Security Testing Canned Recipes for Pentesters
26 The idea here is to reduce this Pulling Results from each Scan Automating them with their API in the Pipeline + Parameterization Understanding and Using Security Testing Tools Understand Security Testing Steps and Processes
27 To This start zap active scan ${TARGET} write results to DB ${DB_PATH} Reducing Friction in the way we use and interact with Security Testing Tools
28 Demo Demo Gods! Please let this work
29 Use-Cases and Patterns Automate Pentest Activities - Creating an Automated Pentest Pipeline Parameterized Application Security Testing in the Pipeline Run Security Regressions in the Pipeline
30 Automated Pentesting Pipeline Automate specific Pentest Scripts in a sequential process Saves time - Pentesters Democratizes Security Testing - Including Engineering and QA
31 Example nmap script scan ${TARGET} nmap print results (run selenium automation script) start zap active scan ${TARGET} write results to DB ${DB_PATH}
32 Demo Demo Gods! Please let this work
33 Parameterized Application Security Testing Pipeline
34 Demo Demo Gods! Please let this work
35 Parameterized Application Security Testing Pipeline
36 Demo Demo Gods! Please let this work
37 Reach Us Website: LinkedIn: abhaybhargav
Being Mean To Your Code: Integrating Security Tools into Your DevOps Pipeline
Being Mean To Your Code: Integrating Security Tools into Your DevOps Pipeline Boston Code Camp 26 November 19, 2016 Robert Hurlbut RobertHurlbut.com @RobertHurlbut Boston Code Camp 26 - Thanks to our Sponsors!
More informationStrengthen and Scale security using DevSecOps
OWASP Indonesia Meetup Strengthen and Scale security using DevSecOps $ www.teachera.io!"# @secfigo % secfigo@gmail.com # whoami Author, Speaker and Community Leader. Speaker/Trainer at Blackhat, AppSec EU,
More informationCreating an AppSec Pipeline with containers in a week. How we failed and succeeded Jeroen Willemsen OWASP benelux days
Creating an AppSec Pipeline with containers in a week How we failed and succeeded Jeroen Willemsen OWASP benelux days About me Jeroen Willemsen @commjoenie jwillemsen@xebia.com Security architect Full-stack
More informationDefectDojo. The Good, the Bad and the Ugly. OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider
DefectDojo The Good, the Bad and the Ugly OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider 2018-05-31 PREFACE CIO: What is the security posture of our applications? How do you handle and communicate
More informationSuman Sourav Director DevSecOps, Vantage Point Security. OWASP Indonesia Day 2017
Suman Sourav Director DevSecOps, Vantage Point Security OWASP Indonesia Day 2017 About me Certified Secure Software Lifecycle Professional (CSSLP) 12+ Years of Experience in Software Security Co-Founder
More informationDevOps Anti-Patterns. Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! COPYRIGHT 2019 MANICODE SECURITY
DevOps Anti-Patterns Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! 31 Anti-Pattern: Throw it Over the Wall Development Operations 32 Anti-Pattern: DevOps Team Silo
More informationBUYER S GUIDE APPLICATION SECURITY BUYER S GUIDE:
BUYER S GUIDE APPLICATION SECURITY BUYER S GUIDE: 15 Questions to Ask Yourself and Your DAST Vendor > An Introduction to the AppSec Market Page 3 Dynamic Application Security Testing Requirements Page
More informationN different strategies to automate OWASP ZAP
OWASP BUCHAREST APPSEC CONFERENCE 13 OCTOBER 2017 The OWASP Foundation http://www.owasp.org N different strategies to automate OWASP ZAP The OWASP Zed Attack Proxy Marudhamaran Gunasekaran Zap Contributor
More informationFramework for Application Security Testing. September 11th, 2018
Framework for Application Security Testing September 11th, 2018 Create thousands of security tests from existing functional tests automatically Wallarm FAST enables secure CI / CD Wallarm FAST has many
More informationApplication Security at Scale
Jake Marcinko Standards Manager, PCI Security Standards Council Jeff Williams CTO, Contrast Security Application Security at Scale AppSec at Scale Delivering Timely Security Solutions / Services to Meet
More informationWeaving Security into Every Application
Weaving Security into Every Application Paul Fox AVP Technology AT&T 2018 TM Forum 1 Cyber Security Accelerating Threat Telecom Breaches 300,000 Number of complaints filed with the FBI Internet Crime Complaint
More informationApplication Security Buyer s Guide
BU Y ER S GUIDE Application Security Buyer s Guide 15 questions to ask yourself and your DAST vendor TABLE OF CONTENTS An Introduction to the AppSec Market 3 Dynamic Application Security Testing Requirements
More informationDriving OWASP ZAP with Selenium
Driving OWASP ZAP with Selenium About Me Mark Torrens - Recently moved into Cyber Security - Based in London - Completing MSc Cyber Security @ University of York - Security Architect for Kainos Mateusz
More informationAzure DevOps. Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region
Azure DevOps Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region What is DevOps? People. Process. Products. Build & Test Deploy DevOps is the union of people, process, and products to
More informationA Tale of Continuous Testing
T22 DevOps/Continuous Delivery Thursday, October 4th, 2018 3:00 PM A Tale of Continuous Testing Presented by: David Lumpkin Craftsy Brought to you by: 350 Corporate Way, Suite 400, Orange Park, FL 32073
More informationApplication Security at DevOps Speed and Portfolio Scale. Jeff Contrast Security
Application Security at DevOps Speed and Portfolio Scale Jeff Williams @planetlevel Contrast Security OWASP XSS Prevention Cheat Sheet 1,000,000 Page Views! https://www.owasp.org/index.php/xss_(cross_site_scripting)_prevention_cheat_sheet
More informationCloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
More informationContinuous Security Testing. In a DevOps World
Continuous Security Testing In a DevOps World About Me Stephen de Vries CTO ContinuumSecurity 60% Security consultant 40% Developer Author: BDD-Security project About Me DevOps is a tool Plan/Code/Build/Test
More informationAppSec in a DevOps World
AppSec in a DevOps World Peter Chestna Director of Developer Engagement 1 2017 VERACODE INC. ACQUIRED BY CA TECHNOLOGIES Who am I? 27 Years Software Development Experience 12 Years Application Security
More informationCONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WHITEPAPER
WHITEPAPER CONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WELCOME TO THE ERA OF SELF-PROTECTING SOFTWARE CONTRASTSECURITY.COM CONTENTS What is Interactive
More informationSecurity DevOps. Automation von Security-Checks in der Build-Kette. Christian
Security DevOps Automation von Security-Checks in der Build-Kette Christian Schneider @cschneider4711 `whoami` www. mail@} Christian-Schneider.net» Software Developer, Whitehat Hacker & Trainer» Freelancer
More informationDevOps A How To for Agility with Security
DevOps A How To for Agility with Security Murray Goldschmidt, COO Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne
More informationTHE ART OF SECURING 100 PRODUCTS. Nir
THE ART OF SECURING 100 PRODUCTS Nir Valtman @ValtmaNir I work for as the Application Security 1st time speaking publicly, except at Mmmm OH, AND Neither of my previous startups succeeded!
More informationApplication security : going quicker
Application security : going quicker The web application firewall example Agenda Agenda o Intro o Application security o The dev team approach o The infra team approach o Impact of the agility o The WAF
More informationHow to spend $3.6M on one coding mistake and other fun stuff you can do with $3.6M. Matias Madou Ph.D., Secure Code Warrior
How to spend $3.6M on one coding mistake and other fun stuff you can do with $3.6M Matias Madou Ph.D., Secure Code Warrior Matias Madou, Ph.D. CTO and Co-Founder Ph.D. in Computer Engineering from Ghent
More informationSecure DevOps: A Puma s Tail
Secure DevOps: A Puma s Tail SANS Secure DevOps Summit Tuesday, October 10th 2017 Eric Johnson (@emjohn20) Eric Johnson, CISSP, GSSP, GWAPT Cypress Data Defense Principal Security Consultant Static code
More informationContinuous Opportunity: DevOps & Security
August 2017 August 15, 2017 Continuous Opportunity: DevOps & Security 2016-2017 SANS Institute All Rights Reserved Introduction Ben Allen Security Engineer at SANS Institute Operations Engineer, Developer
More informationMaja Schreiner. 9th Lean, Agile & Scrum Conference 2017
Maja Schreiner 9th Lean, Agile & Scrum Conference 2017 Senior Test Master @ Swisscom, Switzerland maja.schreiner@gmail.com testmotion.wordpress.com Twitter: majaschreiner process of executing many different
More informationBrochure. Security. Fortify on Demand Dynamic Application Security Testing
Brochure Security Fortify on Demand Dynamic Application Security Testing Brochure Fortify on Demand Application Security as a Service Dynamic Application Security Testing Fortify on Demand delivers application
More informationIn collaborazione con
In collaborazione con 1. Software Security Introduction 2. SDLC frameworks: how OWASP can help on software security 3. OWASP Software Security 5 Dimension Framework 4. Apply the models to a real
More informationAppScan Deployment APPLICATION SECURITY SERVICES. Colin Bell. Applications Security Senior Practice Manager
APPLICATION SECURITY SERVICES AppScan Deployment Colin Bell Applications Security Senior Practice Manager Copyright 2017 HCL Products & Platforms www.hcltech.com The Evolution of Devops 2001 - Continuous
More informationApplication. Security. on line training. Academy. by Appsec Labs
Application Security on line training Academy by Appsec Labs APPSEC LABS ACADEMY APPLICATION SECURITY & SECURE CODING ON LINE TRAINING PROGRAM AppSec Labs is an expert application security company serving
More informationTurbo boost your digital app test automation with Jenkins
Turbo boost your digital app test automation with Jenkins Step-by-Step Tutorial May, 2018 Speakers Sheli Ashkenazi Sr. Product Manager Experitest Jonathan Aharon Sr. Sales Engineer Experitest 2 01 The
More informationApplication Security Use Cases. RASP, WAF, NGWAF, What The Hell is The Difference.
Application Security Use Cases RASP, WAF, NGWAF, What The Hell is The Difference. Acronym Soup July 29, 2016 2 July 29, 2016 3 Definition of Terms WAF Web Application Firewall / waf / noun 1. An appliance,
More informationDevOps and DevSec with
DevOps and DevSec with Joona Immonen Software architect Solita Oy https://www.linkedin.com/in/joonaimmonen Twitter @rinorragi @SolitaOy THIS IS SOLITA Turnover 2015 49,7 Million euros Nearly 500 professionals
More informationMicrosoft 365 powered device webinar series Microsoft 365 powered device Assessment Kit. Alan Maddison, Architect Amit Bhatia, Architect
Microsoft 365 powered device webinar series Microsoft 365 powered device Assessment Kit Alan Maddison, Architect Amit Bhatia, Architect Why did we create the Assessment kit? Assessment objectives Assess
More informationDiscover Best of Show März 2016, Düsseldorf
Discover Best of Show 2016 2. - 3. März 2016, Düsseldorf 2. - 3. März 2016 Softwaresicherheit im Zeitalter von DevOps Lucas von Stockhausen Regional Product Manager Fortify The case for Application Security
More informationTaking Control of Your Application Security
EDUCAUSE Wednesday, May 3 rd Taking Control of Your Application Security 2017 SANS Institute All Rights Reserved INTRODUCTION Eric Johnson, CISSP, GSSP-Java, GSSP-.NET, GWAPT Application Security Curriculum
More informationCLOUD WORKLOAD SECURITY
SOLUTION OVERVIEW CLOUD WORKLOAD SECURITY Bottom line: If you re in IT today, you re already in the cloud. As technology becomes an increasingly important element of business success, the adoption of highly
More informationDe-risk Your Applications. SUBSCRIBE TO EVRY S SECURITY TESTING AS A SERVICE (STaaS) TODAY!
De-risk Your Applications SUBSCRIBE TO EVRY S SECURITY TESTING AS A SERVICE (STaaS) TODAY! With the exponential increase in Web, Mobile, Cloud and IoT applications, the security risks and challenges in
More informationDEVOPSIFYING NETWORK SECURITY. An AlgoSec Technical Whitepaper
DEVOPSIFYING NETWORK SECURITY An AlgoSec Technical Whitepaper Introduction This technical whitepaper presents and discusses the concept of Connectivity as Code, a complementary concept to Infrastructure
More informationWhy test automation projects are failing? Igor Khrol
Why test automation projects are failing? Igor Khrol http://www.khroliz.com About myself Igor Khrol More than 7 years in automated testing Consultant, trainer, manager, engineer, architect Selenium, HP
More informationAGILE AND CONTINUOUS THREAT MODELS
SESSION ID: DEV-R04 AGILE AND CONTINUOUS THREAT MODELS Nancy Davoust Vice President, Security Architecture and Technology Solutions Comcast CONTEXT FOR AGILE AND CONTINUOUS THREAT MODELING The Landscape
More informationDevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1
DevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1 Agenda State of DevOps Value of DevOps Benefitting from DevOps DevSecOps What you can do as InfoSec 2 The State of DevOps - 2017 Automation is
More informationHow to Build an Appium Continuous Testing Pipeline
How to Build an Appium Continuous Testing Pipeline Step-by-Step Tutorial November, 2017 Today s speakers Guy Arieli, CTO, Experitest Ruth Zamir Marketing Director Experitest 01 Why do we need continuous
More informationTesting at Cloud Speed. Matt Tesauro, SANS AppSec 2013 Austin, TX, April 2013
Testing at Cloud Speed Matt Tesauro, SANS AppSec 2013 Austin, TX, April 2013 Who am i? Matt Tesauro Cloud Application Security Guy + OWASP 2 Racker since October 2011 Rackspace s Product Security Group
More informationShift Left Testing: are you ready? Live Webinar, Sept 19
Shift Left Testing: are you ready? Live Webinar, Sept 19 Guy Arieli CTO, Experitest 01 What exactly is Shift Left? Agenda 02 03 How Shift Left affects application development & testing organizational structures
More informationFROM VSTS TO AZURE DEVOPS
#DOH18 FROM VSTS TO AZURE DEVOPS People. Process. Products. Gaetano Paternò @tanopaterno info@gaetanopaterno.it 2 VSTS #DOH18 3 Azure DevOps Azure Boards (ex Work) Deliver value to your users faster using
More informationCHICAGO. How to Tackle Open Source Test Automation in Incredible Ways. Renaissance Hotel 1 West Wacker Drive Chicago IL April 18th April 22th
How to Tackle Open Source Test Automation in Incredible Ways CHICAGO April 18th April 22th Renaissance Hotel 1 West Wacker Drive Chicago IL 60601 Speaker(s): Company: Harpreat Singh & Piyush Sachar Microexcel
More informationSecurity Solution. Web Application
Web Application Security Solution Netsparker is a web application security solution that can be deployed on premise, on demand or a combination of both. Unlike other web application security scanners,
More informationOWASP London Chapter Meeting 30th March 2017
OWASP London Chapter Meeting 30th March 2017 London Chapter Chapter Leaders: Sam Stepanyan (@securestep9) Sherif Mansour (@kerberosmansour) Keeping In Touch: Join the OWASP London mailing list Follow @OWASPLondon
More informationA SEISMIC SHIFT IN APPLICATION SECURITY HOW TO INTEGRATE AND AUTOMATE SECURITY IN THE DEVOPS LIFECYCLE
A SEISMIC SHIFT IN APPLICATION SECURITY HOW TO INTEGRATE AND AUTOMATE SECURITY IN THE DEVOPS LIFECYCLE WHAT'S INSIDE? INTRODUCTION THE TRADITIONAL APPLICATION SECURITY WORKFLOW WHY SHIFT LEFT ISN T ENOUGH
More informationTest Automation Strategies in Continuous Delivery. Nandan Shinde Test Automation Architect (Tech CoE) Cognizant Technology Solutions
Test Automation Strategies in Continuous Delivery Nandan Shinde Test Automation Architect (Tech CoE) Cognizant Technology Solutions The world of application is going through a monumental shift.. Evolving
More informationWill your application be secure enough when Robots produce code for you?
SESSION ID: ASD-W02 Will your application be secure enough when Robots produce code for you? Hasan Yasar Technical Manager, Faculty Member SEI CMU @securelifecycle With the speed of DevOps It is me! I
More informationMonitoring Attack Surface and Integrating Security into DevOps Pipelines
Monitoring Attack Surface and Integrating Security into DevOps Pipelines Dan Cornell @danielcornell 0 Agenda Background Importance of Attack Surface What Does Attack Surface Have to Do with DevOps? Hybrid
More informationStruggling to Integrate Selenium into Your Ice Age Test Management Tools?
WWW.PLUTORA.COM SOLUTION BRIEF Struggling to Integrate Selenium into Your Ice Age Test Management Tools? You want Selenium. Your team wants Selenium. But your outdated testing tools don t work with it.
More informationRide the wave of automation to survive the digital transformation storm. December, 2017
Ride the wave of automation to survive the digital transformation storm December, 2017 Today s speakers Sheli Ashkenazi Product Management Experitest Ruth Zamir Director of Marketing Experitest 2 01 The
More informationIBM Application Security on Cloud
April, 2017 IBM Application Security on Cloud Service Overview Security has and will always be about understanding, managing, and mitigating the risk to an organization s most critical assets. - Dr. Eric
More informationMicro Focus Fortify Application Security
Micro Focus Fortify Application Security Petr Kunstat SW Consultant +420 603 400 377 petr.kunstat@microfocus.com My web/mobile app is secure. What about yours? High level IT Delivery process Business Idea
More informationOWASP Top 10 The Ten Most Critical Web Application Security Risks
OWASP Top 10 The Ten Most Critical Web Application Security Risks The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain
More informationSOLVING THE MOBILE TESTING CONUNDRUM
SOLVING THE MOBILE TESTING CONUNDRUM Even though mobile testing is complex, it can be done successfully with the correct strategy. A sound mobile test automation strategy must include test automation frameworks,
More informationSurrogate Dependencies (in
Surrogate Dependencies (in NodeJS) @DinisCruz London, 29th Sep 2016 Me Developer for 25 years AppSec for 13 years Day jobs: Leader OWASP O2 Platform project Application Security Training JBI Training,
More informationTaking AppSec to 11: AppSec Pipelines, DevOps, and Making Things Better OWASP San Antonio, April Matt Tesauro, Infinitiv
Taking AppSec to 11: AppSec Pipelines, DevOps, and Making Things Better OWASP San Antonio, April 2016 Matt Tesauro, Infinitiv Assembly Lines The Phoenix Project 3 Ways of DevOps Strategies for Improving
More informationAutomating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
More informationSecurity as Code: The Time is Now. Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS
Security as Code: The Time is Now Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS Introduction Business is moving faster to the cloud, and DevOps is accelerating scale and pushing automation
More informationManaging an Application Vulnerability Management Program in a CI/CD Environment. March 29, 2018 OWASP Vancouver - Karim Lalji 1
Managing an Application Vulnerability Management Program in a CI/CD Environment March 29, 2018 OWASP Vancouver - Karim Lalji 1 About Me Karim Lalji Managing Security Consultant (VA/PT) at TELUS Previously:
More information13 th Annual International Software Testing Conference Paper on
1 13 th Annual International Software Testing Conference Paper on SMART- a Comprehensive Framework for Test Automation of Web & Mobile Applications Using Open Source Technologies Author: Anmol Bagga QA
More informationTEST AUTOMATION. Excel Global Solutions Inc. All Rights Reserved.
TEST AUTOMATION Table of Contents Introduction... 3 Automation Frameworks:... 3 Uses for a framework:... 3 Advantages of Test Automation over Manual Testing:... 3 Principles of Test Automation:... 4 Choosing
More informationV Conference on Application Security and Modern Technologies
V Conference on Application Security and Modern Technologies In collaborazione con Venezia, Università Ca Foscari 6 Ottobre 2017 1 Matteo Meucci OWASP Nuovi standard per la sicurezza applicativa 2
More informationTesting NodeJS, REST APIs and MongoDB with UFT January 19, 2016
Testing NodeJS, REST APIs and MongoDB with UFT January 19, 2016 Brought to you by Hosted By Bernard P. Szymczak Ohio Chapter Leader HP Software Education SIG Leader TQA SIG Leader Today s Speakers Ori
More informationTHE EMERGENT CLOUD SECURITY TOOLCHAIN FOR CI/CD
#RSAC SESSION ID: CSV-T07 THE EMERGENT CLOUD SECURITY TOOLCHAIN FOR CI/CD James Wickett Head of Research Signal Sciences @wickett #RSAC Head of Research @ Signal Sciences Organizer of DevOps Days Austin
More informationHow Can Testing Teams Play a Key Role in DevOps Adoption?
June 3, 2016 How Can Testing Teams Play a Key Role in DevOps Adoption? Sujay Honnamane QA Director @sujayh Rameshkumar Bar Sr. Automation Architect @rameshbar 2016 Cognizant Session take away DevOps Overview
More informationTRAINING CURRICULUM 2017 Q2
TRAINING CURRICULUM 2017 Q2 Index 3 Why Security Compass? 4 Discover Role Based Training 6 SSP Suites 7 CSSLP Training 8 Course Catalogue 14 What Can We Do For You? Why Security Compass? Role-Based Training
More informationOpen Source SAST and DAST Tools for WebApp Pen Testing
Open Source SAST and DAST Tools for WebApp Pen Testing Drew Kirkpatrick Funded by: Department of Homeland Security Science and Technology Directorate Cyber Security Division Web Application Pen Testing
More informationCAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR
PDF NESSUS VULNERABILITY SCANNER - BASICS - SECURITYLEARN CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR 1 / 6 2 / 6 3 / 6 website vulnerability scanner pdf Basics vulnerability scanning with NESSUS...
More informationTHE THREE WAYS OF SECURITY. Jeff Williams Co-founder and CTO Contrast Security
THE THREE WAYS OF SECURITY Jeff Williams Co-founder and CTO Contrast Security 1. TODAY S AVERAGE APPLICATION IS A SECURITY DISASTER 2. SOFTWARE IS LEAVING SECURITY IN THE DUST SOFTWARE Typical enterprise
More informationC1: Define Security Requirements
OWASP Top 10 Proactive Controls IEEE Top 10 Software Security Design Flaws OWASP Top 10 Vulnerabilities Mitigated OWASP Mobile Top 10 Vulnerabilities Mitigated C1: Define Security Requirements A security
More informationSecure Agile How to make secure applications using Agile Methods Thomas Stiehm, CTO
Secure Agile How to make secure applications using Agile Methods Thomas Stiehm, CTO tom.stiehm@coveros.com 1 About Coveros Coveros helps organizations accelerate the delivery of business value through
More informationInstructor-led Training Course Catalog
Instructor-led Training Course Catalog January 2018 800.873.8193 sig-info@synopsys.com synopsys.com/software GENERAL DISCLAIMER This document presents details about the training offerings from Synopsys
More informationWeb Applications Penetration Testing
Web Applications Penetration Testing Team Members: Rahul Motwani (2016ME10675) Akshat Khare (2016CS10315) ftarth Chopra (2016TT10829) Supervisor: Prof. Ranjan Bose Before proceeding further, we would like
More informationMAKING THE MOVE TO AUTOMATED TESTING
WHITE PAPER MAKING THE MOVE TO AUTOMATED TESTING 7 Key Questions and Answers If you work in DevOps or software QA, you likely already know why automated software testing is essential for quality control
More informationDevSecOps Whitepaper. The business benefits and best practices of DevSecOps implementation. DevSecCon.com
DevSecOps Whitepaper The business benefits and best practices of DevSecOps implementation DevSecCon.com Index About this Whitepaper 3 Why DevSecOps? 4 What is DevSecOps? 6 Benefits of DevSecOps 7 Best
More informationDevSecOps Shift Left Security. Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis
DevSecOps Shift Left Security Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis Themes Vulnerabilities are Low Hanging Fruit Why so many breaches that Anti-Virus
More informationOWASP ESAPI SwingSet. OWASP 26 April Fabio Cerullo Ireland Chapter Leader Global Education Committee
OWASP ESAPI SwingSet OWASP 26 April 2011 Fabio Cerullo Ireland Chapter Leader Global Education Committee fcerullo@owasp.org +353 87 7817468 Copyright The OWASP Foundation Permission is granted to copy,
More informationIntegrate IBM Rational Application Developer and IBM Security AppScan Source Edition
Integrate IBM Rational Application Developer and IBM Security AppScan Source Edition Security testing for the Rational Application Developer application G Kiran Kumar Singh & Arnab Roy July 19, 2012 Page
More informationHybrid 2.0 In search of the holy grail
Hybrid 2.0 In search of the holy grail A Talk for OWASP BeNeLux by Roger Thornton Founder/CTO Fortify Software Inc 2008 All Right Reserved Fortify Software Inc. 2 Before we Begin: Expectations Objectives
More informationAbout Us. Services CONSULTING OUTSOURCING TRAINING MENTORING STAFF AUGMENTATION 9/9/2016
About Us Incorporated in January, 2003 QA and QC in expertise focused on functional, performance and application security validation HPE Software Gold Partner, HPE Authorized Software Support Partner &
More informationOvercoming the Challenges of Automating Security in a DevOps Environment
SESSION ID: LAB-W02 Overcoming the Challenges of Automating Security in a DevOps Environment Murray Goldschmidt Chief Operating Officer Sense of Security @ITsecurityAU Michael McKinnon Director, Commercial
More informationJavaScript And Other New Features in LeanFT January 27, Copyright 2016 Vivit Worldwide
JavaScript And Other New Features in LeanFT 12.52 January 27, 2016 Copyright 2016 Vivit Worldwide Brought to you by Copyright 2016 Vivit Worldwide Hosted By: Mihai Grigorescu TQA SIG Leader Copyright 2016
More informationDevOps CICD for VNF a NetOps Approach
DevOps CICD for VNF a NetOps Approach Renato Fichmann Senior Solutions Architect Cisco Advanced Services Cisco Spark How Questions? Use Cisco Spark to communicate with the speaker after the session 1.
More informationQMS ISO 9001:2015 CERTIFIED COMPANY Software Testing TRAINING.
QMS ISO 9001:2015 CERTIFIED COMPANY Software Testing TRAINING www.webliquidinfotech.com What you Learn: What is Software Testing? Why Testing is Important? Scope of Software Testing Objectives of Software
More information.NET JAVA C ASE. Certified. Certified. Application Security Engineer.
.NET C ASE Certified Application Security Engineer JAVA C ASE Certified Application Security Engineer Certified Application Security Engineer www.eccouncil.org EC-Council Course Description The Certified
More informationAN ISO 9001:2008 CERTIFIED COMPANY. Software Testing TRAINING.
AN ISO 9001:2008 CERTIFIED COMPANY Software Testing TRAINING www.webliquids.com ABOUT US Who we are: WebLiquids is an ISO (9001:2008), Google, Microsoft Certified Advanced Web Educational Training Organisation.
More informationBuilding a Customized Test Automation Framework Using Open Source Tools
Building a Customized Test Automation Framework Using Open Source Tools August, 2016 Contents Executive Summary...03 Need for Test Automation...04 Overcoming Limitations of Open Source Tools...04 Test
More informationTHE FUTURE OF APPSEC AUTOMATION WHY YOUR APPSEC EXPERTS ARE KILLING YOU. Jeff Williams,
THE FUTURE OF APPSEC AUTOMATION WHY YOUR APPSEC EXPERTS ARE KILLING YOU Jeff Williams, CTO @planetlevel CONTRAST SECURITY 291 Lambert Avenue Palo Alto, California 94306 www.contrastsecurity.com ARE YOU
More informationPenetration Testing. James Walden Northern Kentucky University
Penetration Testing James Walden Northern Kentucky University Topics 1. What is Penetration Testing? 2. Rules of Engagement 3. Penetration Testing Process 4. Map the Application 5. Analyze the Application
More informationPEACHTECH PEACH API SECURITY AUTOMATING API SECURITY TESTING. Peach.tech
PEACH API SECURITY AUTOMATING API SECURITY TESTING Peach.tech Table of Contents Introduction... 3 Industry Trends... 3 API growth... 3 Agile and Continuous Development Frameworks... 4 Gaps in Tooling...
More informationAn SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec,
An SDLC for the DevSecOps Era Or SecDevOps, or DevOpsSec, or zane@signalsciences.com @zanelackey Who you ll be heckling today Started out in offense Pentester / researcher at isec Partners / NCC Group
More informationTHE EMERGING PRODUCT SECURITY LEADER DISCIPLINE
SESSION ID: DEV-F02 THE EMERGING PRODUCT SECURITY LEADER DISCIPLINE Matt Clapham Principal Product Security Leader GE Digital (Healthcare) @ProdSec Agenda What is product security What is a product security
More informationSeeTest Quality Assurance Platform On-premise Digital Assurance Lab
SeeTest Quality Assurance Platform On-premise Digital Assurance Lab On-premise Digital Assurance Lab Centrally manage browsers & mobile devices (physical/emulated), and allow your team to remotely access
More information