Large-Scale Application Attack Surface Management
summary
Claims a working scalable ASM architecture at Traveloka that catalogs hundreds to thousands of hostnames, enriches each entry with routes, request/response specs and links to repos, and integrates into CI/CD to drive automated tests and alerts. Enumeration uses static code parsing, client-side crawling with headless browsers, DNS reads from Amazon R 53, regex/scrape tools and runtime instrumentation with Freda to hook route registration. A central aggregator and dashboard normalize results and produce actionable notifications so the system actually finds missing endpoints and speeds review.
AI-written summary · about
chapters (15)
- 0:00Introduction and welcome
- 1:13Agenda and core concepts
- 2:30Defining attack surface
- 5:22Benefits and core principles
- 7:11Strategic implementation
- 8:53Challenges and considerations
- 10:55Large-scale surface discovery
- 15:31Web application enrichment
- 19:17Static analysis and tooling
- 26:30Mobile and desktop surface
- 32:47Integrated discovery pipeline
- 34:54Code security testability
- 37:27Standardization and maturity
- 38:56Community improvements
- 40:27Q&A and closing
related talks
29mMapping the SaaS Attack Surface
29mFlagship Projects: Amass
32mAutomating Web Application Bug Hunting
48mMonitoring Application Attack Surface and Integrating Security into DevOps
27mCommon Application Security Mistakes that Enable Automated Attacks
52mattack-driven defense
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
16mDevelopment of Asset Mapping External Attack tool