Adding DAST to CI/CD, Without Any Losing Friends
summary
Adding a dynamic application security scanner straight into CI/CD without tuning inflates builds (one minute ballooning to nine minutes — a 900% slowdown) unless scope and tuning are specific: use .har files to laser-focus scans, only block emergency findings in the release pipeline, uncheck irrelevant tech checks. Practical options include scheduled overnight full scans, one‑off/manual scans, or pen tests outside the pipeline. Tools and techniques named: DAST (Bright mentioned), Selenium‑recorded flows, SAST, SCA, IAST and secret scanners; the workable claim is faster, accurate DAST through narrower, staged use.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:02DAST in CI/CD challenges
- 3:06Speaker credentials
- 4:07Insecure software problem
- 6:14What is DAST
- 7:17DAST for web apps
- 8:40DevOps and CI/CD
- 10:25DAST strategies for speed
- 13:14Security testing outside CI/CD
- 15:17Other security testing types
- 16:43DAST in SDLC
- 17:26DAST speed in CI/CD
- 17:47Conclusion and key takeaways
- 18:52Resources
related talks
39mSecurity Tooling in Your DevOps Pipeline
22mSecurity for Developers
44mSecurity Practices Useful in Agile Development
37mDevSecOps Guide to Bulletproof Your Development Workflow
13mUnderstanding DevSecOps: Risk defense across your SDLC
19mApplication Security at High Velocity
40mDevSecOps Guide to Bulletproof Your Development Workflow
25mHow to select between SAST, DAST, IAST, RASP, and AST