Insecure Expectations
summary
Tests and specs become security checks: concrete examples show RSpec and cucumber scenarios driving WebDriver to prove SQLi XSS CSRF mass‑assignment and missing secure headers. An open‑source kit called swtf runs against a deliberately vulnerable app named triage, using Selenium and direct Net::HTTP for headers. At one Rails meetup ~400 people attend fewer than 50 know OWASP and only 2 write security tests, and the demo works as an educational framework not a scanner.
AI-written summary · about
chapters (23)
- 0:00Start
- 5:12CURRENTLY WRITE SECURITY TESTS?
- 5:25INSECURE EXPECTATIONS
- 11:44SECURITY WEB TESTING FRAMEWORK
- 18:30javascript Scenario Outline: check for secure headers attempt Given a new project created by a user And the page is "cpages" When the header is "" Then the header value should be ""
- 19:40WRITE TESTS THAT ILLUSTRATE THE SECURITY ISSUES
- 20:06TRY TO ILLUSTRATE HOW EASY IT WOULD BE TO WRITE SECURITY TESTS
- 28:01PLATFORM FOR EDUCATING DEVELOPERS
- 28:12LANGUAGE FOR COMMUNICATING WITH BUSINESS OWNERS
- 28:32MECHANISM FOR MAKING IT EASIER TO IMPLEMENT TESTS.
- 28:46HOW MANY PEOPLE HAVE HADA PENETRATION TEST AGAINST THEIR APPLICATION?
- 31:03WHAT IF À DEVELOPER COULD FIX À SECURITY ISSUE BY MAKING THE TEST PASS.
- 32:15GOOD: ALMOST EVERY CLIENT ENGAGEMENT BENEFITS FROM OWASP
- 32:48BAD: OWASP MEETINGS I HAVE BEEN TO ARE PREDOMINANTLY SECURITY PEOPLE
- 33:34HOW DO WE "COMMUNICATE"
- 34:50HAVE ATTENDED DEVELOPER CONFERENCES THIS YEAR?
- 38:45GO TO DEV MEETUP GO DEV CONFERENCE CONTRIBUTE TO OSS LISTEN
- 40:40IDENTIFY TECHNOLOGY LEADERS AND APPROACH THEM
- 42:41FORM AN OUTREACH SUBCOMMITTEE
- 43:25DE-"CRIMINALIZE" APPLICATION SECURITY IGNORANCE
- 43:52INVITE DEVELOPERS TO SPEAK
- 44:09FIND ACTIVITIES THAT DEVELOPERS CAN PARTICIPATE IN AT MEETINGS
- 44:34GET DEVELOPERS ON THE OWASP BOARD
related talks
27mHow to Start Security Testing Without Fear
44mShift-Left-Security with the Security Test Pyramid
27mHow Security, Development & Testing can work together to stop ...
34mThe World of Rails Security
43mSecurity Testing Tools: Can I Touch You There?
46mAutomating Security Testing with Functional Testing Test Cases
57mShift Left Security with the Security Test Pyramid
23mWeb Application Security - owasp top 10 vulnerabilities