Insecure Expectations

on YouTube ↗46m

" summary

Tests and specs become security checks: concrete examples show RSpec and cucumber scenarios driving WebDriver to prove SQLi XSS CSRF mass‑assignment and missing secure headers. An open‑source kit called swtf runs against a deliberately vulnerable app named triage, using Selenium and direct Net::HTTP for headers. At one Rails meetup ~400 people attend fewer than 50 know OWASP and only 2 write security tests, and the demo works as an educational framework not a scanner.

AI-written summary · about

" chapters (23)

1. 0:00Start
2. 5:12CURRENTLY WRITE SECURITY TESTS?
3. 5:25INSECURE EXPECTATIONS
4. 11:44SECURITY WEB TESTING FRAMEWORK
5. 18:30javascript Scenario Outline: check for secure headers attempt Given a new project created by a user And the page is "cpages" When the header is "" Then the header value should be ""
6. 19:40WRITE TESTS THAT ILLUSTRATE THE SECURITY ISSUES
7. 20:06TRY TO ILLUSTRATE HOW EASY IT WOULD BE TO WRITE SECURITY TESTS
8. 28:01PLATFORM FOR EDUCATING DEVELOPERS
9. 28:12LANGUAGE FOR COMMUNICATING WITH BUSINESS OWNERS
10. 28:32MECHANISM FOR MAKING IT EASIER TO IMPLEMENT TESTS.
11. 28:46HOW MANY PEOPLE HAVE HADA PENETRATION TEST AGAINST THEIR APPLICATION?
12. 31:03WHAT IF À DEVELOPER COULD FIX À SECURITY ISSUE BY MAKING THE TEST PASS.
13. 32:15GOOD: ALMOST EVERY CLIENT ENGAGEMENT BENEFITS FROM OWASP
14. 32:48BAD: OWASP MEETINGS I HAVE BEEN TO ARE PREDOMINANTLY SECURITY PEOPLE
15. 33:34HOW DO WE "COMMUNICATE"
16. 34:50HAVE ATTENDED DEVELOPER CONFERENCES THIS YEAR?
17. 38:45GO TO DEV MEETUP GO DEV CONFERENCE CONTRIBUTE TO OSS LISTEN
18. 40:40IDENTIFY TECHNOLOGY LEADERS AND APPROACH THEM
19. 42:41FORM AN OUTREACH SUBCOMMITTEE
20. 43:25DE-"CRIMINALIZE" APPLICATION SECURITY IGNORANCE
21. 43:52INVITE DEVELOPERS TO SPEAK
22. 44:09FIND ACTIVITIES THAT DEVELOPERS CAN PARTICIPATE IN AT MEETINGS
23. 44:34GET DEVELOPERS ON THE OWASP BOARD

" related talks

• 27mHow to Start Security Testing Without FearSander van Beek · Agile Testing Days 2024
• 44mShift-Left-Security with the Security Test PyramidAndreas Falk · Devoxx Ukraine 2021
• 27mHow Security, Development & Testing can work together to stop ...S. Chaplin · OWASP 20th Anniversary 2021
• 34mThe World of Rails SecurityJustin Collins · RailsConf 2015
• 43mSecurity Testing Tools: Can I Touch You There?Milan Gabor · TestCon Moscow 2019
• 46mAutomating Security Testing with Functional Testing Test CasesLavakumar Kuppan · nullcon Goa 2019
• 57mShift Left Security with the Security Test PyramidAndreas Falk · OWASP 2022 Global AppSec Europe Virtual Event
• 23mWeb Application Security - owasp top 10 vulnerabilitiesShan Jun Ng · FOSSASIA Summit 2017