Scaling Security Assessment at the Speed of DevOps
summary
A distributed security-testing framework called Norad automates and aggregates scanners (qualus, Vol, ZAP, nmap, sslyze, server‑spec) as Docker images, uses HAProxy, RabbitMQ and Vault for orchestration and credential storage, and supports an on‑prem relay to scan private subnets. The demo spins up containers, discovers three machines (public SSH, private SSH+web), runs Vol and ZAP, and returns failing CVE results to the Rails API; test content uses a Beacon gem scaffold and CI, and open‑source release is planned within a month.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:23Core Team
- 2:42Development Trends (Cisco)
- 5:10Security Testing is Hard
- 8:56Deployment Models
- 10:10Architecture: General
- 12:14AWS Demo Network
- 13:00Norad Terminology
- 15:32Architecture: Public Scan
- 20:43Architecture: Relay
- 21:26Relay Connectivity Requirements
- 29:48Enterprise (Dev-Box too)
- 31:21Security Tests: Overview
- 34:03Security Tests: Creation
- 38:10Security Tests: Dockerfile
- 38:54Security Tests: manifest.yml
- 40:11Security Tests: Documentation NORAD
- 40:31Security Tests: Wrapper Script
- 42:59Security Tests: Unit Testing
- 43:12Security Tests: Unit Test Targets
- 43:38Test Content Examples
- 44:52Security Tests: Serverspec
- 45:40Documentation: API
- 45:51Documentation: Relay
related talks
01h 18mDevSecOps - Automating Security in DevOps
36mContinuous Security Testing with OWASP secureCodeBox in Kubernetes
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
43mBuilding a Secure DevOps Pipeline
09mGraphQL Security Testing Automation for Developers
46mMaking Security Agile
36mSecurity Scanning - Past/Present/Future
52mApplication Security at DevOps Speed and portfolio scale