Practical Dynamic Application Security Testing within an Enterprise
summary
Describes a Java-based scanner integrated into CI/CD and a RESTful API that delegates work to containers running passive scans, ingesting URLs from Splunk/LogStash/Tealeaf/SiteCatalyst. Shows an API with bulk-scan, status and results endpoints that return a unique scan ID and container-level control, uses ECS/Kubernetes to parallelize, and claims the platform scans over 2000 urls in less than 2 hours. Passive checks target TLS, cookie flags and misconfigurations; full active scans remain recommended for deeper issues.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:20About Me
- 5:15Overview AST
- 8:04Assessments never stop...
- 9:45AST Detailed
- 12:17Scanner and CLI
- 16:00OST Overview
- 18:23Cast a wide net
- 19:04Why OST?
- 20:38How to OST
- 22:19OST Detailed
- 27:42Sample bulk-scan response
- 27:55Sample bulk-scan data flow
- 29:28Sample bulk-scan results
- 30:14Filling the Gap
- 31:25Conclusion
related talks
09mAutomated Application Security Testing
52mApplication Security at DevOps Speed and portfolio scale
39mContinuous Security at the Next Level
21mAdding DAST to CI/CD, Without Any Losing Friends
45mAutomated Security Testing in a DevOps world
09mAutomated Application Security Testing
35mContinuous Cloud Security Automation
47mRollercoaster of Security Automation