Automated Security Scanning in Payment Card Industry

on YouTube ↗21m

" summary

Claim: reuse existing Selenium WebDriver suites as a proxyed input to an automated scanner (OWASP ZAP) to catch web vulnerabilities early with minimal cost and setup. The talk shows the proxy and WebDriver code, describes passive and active scans, Selenium WebDriver driving browsers through OWASP ZAP, exporting HTML reports into a CI pipeline, and the real-world time sink of false positives that require triage. Results run in CI and reduce late auditor surprises.

AI-written summary · about

" chapters (4)

1. 0:00Start
2. 1:211. Why security?
3. 2:34Data integrity and management People give out their private data.
4. 10:04How to enable scanner in my automation?

" related talks

• 47mAutomated Security Scanning in Payment IndustryMichal Buczko · QA Fest 2018
• 33mAutomated Security Scanning in Payment Card IndustryMichal Buczko · TestCon Vilnius 2018
• 35mAutomated Security TestingAlan Parkinson · SeleniumConf 2012 London
• 36mLet's take baby steps to security testingChristina Thalayasingam · SeleniumConf London 2019
• 45mSecurity Testing with OWASP ZAP in CI/CDSimon Bennetts · Codemotion Amsterdam 2017
• 01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slidelessChristian Nils Schneider · DevOps Conference 2018
• 58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack ProxyBen Walther · AppSec California 2014
• 41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And SecurityPeter Hauschulz · OWASP Global AppSec Amsterdam 2019