SAST'madness and Courage
summary
A survey of static application security testing (SAST) tools: types of static analyzers, differences between them, and a comparison. Practical guidance on using SAST effectively to find vulnerabilities, with examples of the kinds of security defects SAST can detect.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:30What is SAST and SCA
- 3:21SAST tools overview
- 5:51SAST tool selection criteria
- 8:03Russian SAST solutions
- 9:51Free SAST tools overview
- 10:14SAST comparison example
- 14:05SCA tools overview
- 15:52Russian SCA solutions
- 16:55SCA comparison example
- 18:19IaC config scanners
- 19:04Secret scanners in code
- 19:46Why use SAST and SCA
- 20:06Actuator vulnerability
- 21:51Finding virtual hosts
- 23:18Mobile app hacking
- 27:14Template injections
- 29:02Mass Assignment flaw
- 31:14SAST rule creation
- 32:37Summary
- 33:40New initiatives
- 34:22Q&A
related talks
22mSecurity for Developers
25mHow to select between SAST, DAST, IAST, RASP, and AST
49mMan vs Machine: manual and automated security testing
33mOverwhelmed by Vulnerability Triage Hear a Blend of Finest Best Practices
32mSAST and Sensibility: A Rubyist’s Guide to Static...
21mAdding DAST to CI/CD, Without Any Losing Friends
35mKnow Your Tools: Quirks And Flaws, Integrating SAST Into Your Pipeline
44mSecurity Practices Useful in Agile Development