SUSTO: Systematic Universal Security Testing Orchestration
summary
Proposes a concrete open source platform to systematize the long tail of security checks, claiming hundreds of reusable rules, plugin connectors to SAST/DAST/SCA/container scanners, and pass/fail or score outputs per control. Shows a proof‑of‑concept Python prototype moving to Go, a CLI amplifier named capo, and an orchestration engine called Overlord that runs parameterized tests like a TLS 1.2 minimum test, maps standards to rules, and integrates into CI/CD.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 1:50Current security state
- 4:34Infrastructure as code
- 7:26Security testing challenges
- 9:09Orchestration hurdles
- 13:10Introducing Sisto
- 16:40Architecture and features
- 21:57Practical implementation
- 23:51Overlord project roadmap
- 33:44Q&A and closing
related talks
47mSecurity Gate: Building a Homegrown SAST Orchestration Platform
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
39mSecurity Tooling in Your DevOps Pipeline
35mOSCAR - Automate software analysis, compliance and security
45mDevSecOps : add Security to your DevOps!
26mSecurity Automation For GraphQL
43mDevSecOps on steroids - Powered by your Selenium tests
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)