Penetration Testing
summary
Managed security team performs timed penetration tests and often pairs Nessus, open source scanners and EDR with manual code review and exploit validation, finding things automation misses. Real incidents include Log4j emergency and a case of unauthenticated API exposing PII that forces breach forensics, entity lists and notifications. Developers use SAST/DAST/IAST/RASP but those miss supply chain zero days, so teams automate dependency checks, enforce defense in depth, validate remediations, and prepare for 36-hour breach notification rules.
AI-written summary · about
chapters (11)
- 0:00Introduction and setup
- 2:03Collaboration with developers
- 3:07Automation in security
- 4:50Regulatory compliance impact
- 6:13Penetration testing basics
- 8:41Top security risks overview
- 10:04Log4j and dependency risks
- 12:11Common web app vulnerabilities
- 14:57Defense in depth strategies
- 17:00Password policies and risks
- 18:45Data breach consequences
related talks
44mApplication Security: Everything we know is wrong
47mPenetration Testing & Red Teaming for Healthcare
31mPenetration Testing in the Release Pipeline
33mWorking with penetration testers as a developer
28mBeyond Penetration Testing: Developing a Defensive Cyber-Workforce
17mManual versus automated penetration testing on AWS
49mMan vs Machine: manual and automated security testing
20mMaking Penetration Tests Actually Useful