Monitoring Application Attack Surface and Integrating Security into DevOps
summary
Claims a reproducible way to calculate a web app’s attack surface, funded by DHS, by merging static and dynamic results into a hybrid analysis mapping engine that generates an attack surface tree from source code. Uses OWASP ZAP and AppScan for dynamic scans, a Python/Java CLI to diff git commits (example: four new URLs detected between commits), and automates triggers into Jenkins, JIRA and Slack. Demos run end-to-end with occasional flakiness but generally succeed, cutting scan scope and feedback time within an 8–12 minute CI window.
AI-written summary · about
chapters (11)
- 0:00Introduction and context
- 3:27Defining attack surface
- 5:44Security in DevOps pipelines
- 7:30Testing and decision making
- 10:19Reporting and manual testing
- 11:51Leveraging attack surface data
- 13:33Hybrid analysis technology
- 21:27Practical applications
- 25:24Command line tools and demos
- 29:14Automation and change detection
- 35:20Implementation and future work
related talks
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
52mApplication Security at DevOps Speed and portfolio scale
34mOWASP Code Pulse and Attack Surface Detector
52mAppSec at DevOps Speed and Portfolio Scale
46mSecurity DevOps - Staying Secure In Agile Projects
30mSecuring DevOps using OWASP DevSecOps Tools
29mMapping the SaaS Attack Surface
49mStop Chasing Vulnerabilities - Introducing Continuous Application Security