OWASP ZAP & DeepFactor Continuous AppSec Observability: Made For Each Other!
summary
Claims that observability plus OWASP ZAP produce more than additive value backed by concrete tooling and numbers: DeepFactor drops into your Kubernetes cluster to observe millions of events per thread and it uses a patented proxy that tells ZAP which IP to scan, removing load balancer setup and enabling internal endpoint scans. Observability finds risky runtime behaviors (example outbound call to Antarctica), trims SCA noise (200 reported CVEs, only 25 actually loaded), and lets ZAP scan only deltas to cut scan time.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:10Agenda
- 2:35About DeepFactor
- 4:55About ZAP
- 5:40Application Security Challenges
- 8:17App Modernization
- 11:45Observability
- 19:30Abstech Tools
- 22:59Why Use Observability
- 26:37Cloud Native Application Example
- 35:11Planning for AppSec
related talks
52mApplication Security at DevOps Speed and portfolio scale
52mAppSec at DevOps Speed and Portfolio Scale
45mSecurity Testing with OWASP ZAP in CI/CD
40mEvolution of AppSec: Perspectives from a Decade of Building OWASP ZAP
58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
12mOWASP ZAP HUD WTF?
47mOWASP ZAP: More Advanced Features
33mAutomated Security Scanning in Payment Card Industry