Working with penetration testers as a developer
summary
Defines pen test follows a methodology and insists it needs experienced humans not scanners, separates pen tests from bug bounties and vulnerability scans, and states red team finds fewer vulnerabilities because it pursues objectives not volume. Scope equals cost so pick common roles to test, give testers authenticated accounts to expose privilege gaps, disable WAF for tester IPs then retest findings with it enabled, keep change minimal and embed testers in project comms.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:26What are we talking about?
- 2:32OWASP SAMM
- 4:33What is a Pentest?
- 5:16What is NOT a Pentest?
- 7:31Can't I just hack my own stuff?
- 10:50Risk Management
- 13:21Mini-Talk: Threat Modelling in 30
- 15:09Finding a partner
- 18:46Time vs Scope vs Cost vs Quality
- 20:09Managing Scope - Engagement Type
- 21:33Pentest methodology
- 23:04Red Team / Adversary Simulation
- 24:33Scope - Target Environment
- 26:31Managing Scope - Roles
- 27:43Managing Scope - Interfaces
- 28:25Managing Scope - Infrastructure
- 30:26During the engagement
- 31:17Post Engagement
- 31:34Summary
related talks
20mMaking Penetration Tests Actually Useful
19mPenetration Testing
52mApplication Penetration Testing – DOs and DON‘Ts
39mAre Pentests Relevant with Bug Bounties
56mBuilding An Effective Application Penetration Testing Team
12mConfessions of a reformed pentester
29mHow to run a Pentesting Engagement
44mApplication Security: Everything we know is wrong