Automated Security Testing in a DevOps world

on YouTube ↗45m

" summary

Shows how to add concrete automated checks to a Java CI pipeline: OWASP Dependency Check flags known CVEs (and false positives from broad CPEs), FindSecBugs (SpotBugs extension) surfaces CSRF and SQL injection in code, and a proof‑of‑concept ZAP via Testcontainers spins up the app and finds SQLi and XSS at runtime. Demos use Spring Boot, Docker and GitLab; the testcontainer ZAP integration works but is POC and noisy.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 1:30DevOps security pipelines
3. 8:11Dependency scanning
4. 20:03Static analysis
5. 27:20Dynamic security testing
6. 39:03Conclusion and Q&A

" related talks

• 01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slidelessChristian Nils Schneider · DevOps Conference 2018
• 58mOpen Source Pentesting and Security Analysis Tools: the DevOps wayChristian Nils Schneider · DevOpsCon Spring 2019
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019
• 45mSecurity Testing with OWASP ZAP in CI/CDSimon Bennetts · Codemotion Amsterdam 2017
• 52mApplication Security at DevOps Speed and portfolio scaleJeff Williams · AppSec California 2014
• 01h 18mDevSecOps - Automating Security in DevOpsAnand Tiwari · DevOpsDays Boston 2019
• 46mSecurity DevOps - Staying Secure In Agile ProjectsChristian Nils Schneider · OWASP AppSec Research (AppSecEU) 2015
• 36mSecurity Test Driven Development (STDD) Using Selenium/AppiumSurendran Ethiraj · SeleniumConf Austin 2017