DevSecOps on steroids - Powered by your Selenium tests
summary
Claims that 90% of incidents exploit known bugs and malware rose ~40% year‑on‑year, and demonstrates a concrete pipeline: run SAST and SCA in the IDE, execute DAST after deploy, add an IAST agent and RASP in production. Shows Selenium + TestNG + Java setting a proxy on localhost:7777 and passing ChromeOptions plus an Overstep/OWASP ZAP API key to drive DAST, generate an HTML report, and surface real findings (including a vulnerable JS library) alongside green functional tests. Recommends IDE plugins and automated CI execution. SAST / DAST / IAST / RASP
AI-written summary · about
chapters (18)
- 0:00Start
- 2:57Objectives
- 3:26Four Security Testing Approaches
- 4:16Motivation Why I Went into this Topic
- 8:14Vulnerability Assessment
- 8:48Compliance Testing
- 9:10Function Security Testing
- 9:45Non-Function Security Tests
- 10:50Security Testing Approaches
- 12:11Dynamic Application Security Testing
- 18:34Thread Modeling
- 19:07Coding
- 19:20Static Analyzers
- 21:58Source Code
- 25:31Proxy Configuration
- 26:19Client Api
- 29:57Steps How To Come to the Secure Pipeline
- 35:43What Plugins Do You Recommend
related talks
36mSecurity Test Driven Development (STDD) Using Selenium/Appium
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
43mJumpstarting Your DevSecOps Pipeline with IAST and RASP
36mLet's take baby steps to security testing
46mSecurity DevOps - Staying Secure In Agile Projects
45mAutomated Security Testing in a DevOps world
52mAppSec at DevOps Speed and Portfolio Scale