A Shock to the System Static Analysis for Real AppSec
summary
Argues that combining static analysis with DevOps automation and pentesting yields actionable findings but only if teams trim false positives and focus tools on each tech stack. Demonstrations use SonarQube, Bandit, MobSF, ShellCheck, and dependency checks like yarn audit (example run reports 44 vulnerabilities, 2 high) plus CFN‑Nag for CloudFormation. Shows a Vagrant/Ansible VM repo static-analysis-ttp that provisions SonarQube, runs scans, finds hard‑coded credentials, and produces a usable dashboard for remediation.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:48Brief
- 1:33Outline
- 2:29Static Analysis
- 6:42Tooling
- 12:07Demo
- 13:07Configuration
- 14:27Provisioning
- 22:42Stack Analysis
- 23:52Sonar Cube
- 25:07AppSec Program
- 27:47Automation
- 31:52Live Demo
- 35:12cfnag
- 37:22Communication
- 42:07Stack Analysis Engagement
- 44:32Questions
related talks
33mBattle Tested Application Security
39mPractical Static Analysis for Continuous Application Security
47mRollercoaster of Security Automation
42mContinuous Security: Integrate security tools into your DevOps Pipeline
52mApplication Security at DevOps Speed and portfolio scale
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
49mLessons from DevSecOps Trenches
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers