Automated Security Scanning in Payment Industry
summary
Reuses existing UI automation to feed an HTTP proxy scanner so a few lines of configuration make WebDriver drive an OWASP ZAProxy session, decode HTTPS by installing ZAP’s cert, and run active scans that find SQL injection XSS and CSRF. Automated scans yield ~60–80% false positives so the team invests about a week to catalogue them; CI integration (Jenkins) runs nightly scans. The approach cuts a yearly audit from two weeks to PCI DSS audit reduced from two weeks to three days but can wreck production data if run against live DBs.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:37Why Security Is So Important
- 2:40Alternative Ways How To Integrate the Automation with the Security Scanning
- 5:18Economic Impact around this Cyber Security Attacks
- 33:32Benefits
- 44:17Does Zap Work with some Other Browsers
related talks
21mAutomated Security Scanning in Payment Card Industry
33mAutomated Security Scanning in Payment Card Industry
35mAutomated Security Testing
45mSecurity Testing with OWASP ZAP in CI/CD
09mAutomated Application Security Testing
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
46mSecurity DevOps - Staying Secure In Agile Projects
47mRollercoaster of Security Automation