Building Your Application Security Data Hub: The Imperative for Structured Vulnerability Information

on YouTube ↗50m

" summary

Centralizes and normalizes scanner and manual test output so one unified list replaces overlapping 300‑page PDFs, merging static, dynamic and component scans, deduping duplicates and tracking reappearances; pushes issues into defect trackers (JIRA/Bugzilla) and IDEs via plugins, automates intake from CI with a Jenkins plugin, seeds scanners like OWASP ZAP, creates virtual‑patch rules for WAFs, uses lightweight source mapping for Java/JSP/Spring to link dynamic results to lines of code, and reports mean-time-to-fix from data on GitHub.

AI-written summary · about

" chapters (31)

1. 0:00Start
2. 2:52Agenda
3. 3:29Spans Multiple Disciplines
4. 7:27Scale of the Problem
5. 9:11What to Do About It?
6. 12:52So What Does This Look Like?
7. 13:42Automation
8. 14:09Open Source App Security Data Hub
9. 15:17Supported Technologies
10. 16:19Vulnerability Management
11. 16:56Vulnerability Detection
12. 20:29What is a Unique Vulnerability?
13. 21:58Why Common Weakness Enumeration?
14. 22:21Fill ThreadFix Up With Vulnerability Data
15. 24:26ThreadFix Jenkins Configuration
16. 24:50What Does ThreadFix Do With Scan Results
17. 27:30Know What Would Make My Life Easier?
18. 28:39Hybrid Analysis Mapping (HAM)
19. 29:56Demo: De-Duplicate Dynamic RESTful Scanner Results
20. 30:29Demo: Application Attack Surface (CLI)
21. 31:09Demo: Seed Scanner with Attack Surface
22. 31:59Vulnerability Mitigation
23. 33:26Demo: Generating Virtual Patches
24. 34:09Vulnerability Remediation
25. 37:28Mapping Vulnerabilities to Defects
26. 38:39Demo: Defect Tracker Integration
27. 40:30IDE Plug Ins
28. 42:07Demo: Maping Vulnerabilities in IDE
29. 43:18Demo: Vulnerability Filtering
30. 46:22What to Look For?
31. 47:21Demo: Reporting

" related talks

• 43mBuilding a Secure DevOps PipelineAaron Weaver · AppSec USA 2017
• 40mMaking Vulnerability Management Less Painful with OWASP DefectDojoGreg Anderson · AppSec USA 2017
• 52mApplication Security at DevOps Speed and portfolio scaleJeff Williams · AppSec California 2014
• 30mDefectDojo ProjectTimo Pagel, Stefan Fleckenstein · OWASP 2022 Global AppSec Europe Virtual Event
• 47mRollercoaster of Security AutomationArtem Rozumenko · Selenium Camp 2019
• 01h 18mDevSecOps - Automating Security in DevOpsAnand Tiwari · DevOpsDays Boston 2019
• 33mBattle Tested Application SecurityTy Sbano · OWASP AppSec USA 2018
• 39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...Marine Du Mesnil · Devoxx France 2024