Chimera: Securing a Cloud App Ecosystem with ZAP at Scale
summary
Chimera is a cloud service that runs ZAP plus nikto and nmap on Heroku to scan an AppExchange of roughly 2,800–3,000 apps, handling authenticated scans with an auto-login phantomjs engine, storing jobs in a Salesforce backing org and Redis, and pruning duplicate findings with vulnerability pruning to reduce noise. It finds XSS ~20% of the time, info disclosure ~11% and CSRF ~6%, processes ~1,800 tests/year, averages 1.95 tests to pass, and scales to hundreds of concurrent scanners on Heroku.
AI-written summary · about
chapters (21)
- 0:00Start
- 10:35Why Secure the Ecosystem?
- 12:33Status Quo
- 14:37The Five Stages of Security Grief
- 16:07Chimera as a Force Multiplier
- 17:17User Point of View
- 22:11Scanners
- 23:17Heroku - ZAP at Scale
- 24:49Database and Redis
- 26:24Custom Code
- 29:29ZAP + Python
- 31:20Escalations
- 32:31Exceptions
- 33:41Vulnerability Pruning
- 34:124 Vulnerabilities Found
- 35:46Evidence Trimming + Highlighting
- 36:27Report Demo
- 36:38What's Next?
- 37:16Threat Intel
- 39:03Giving Back
- 39:48Conclusions
related talks
45mSecurity Testing with OWASP ZAP in CI/CD
33mAutomated Security Scanning in Payment Card Industry
36mLet's take baby steps to security testing
04mSecurity Testing for JS Apps, Node Congress
35mAutomated Security Testing
46mMaking Security Agile
41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security
59mZAP Project