Topics of Interest: Automated Finding Correlation where do SAST, DAST and ...
summary
Built an automated correlation service that matches IAST, DAST and SAST findings and runs them against the OWASP Benchmark. IAST hits 100% on the benchmark, SAST with default settings reports ~5,000 findings, DAST reports ~600, and correlation collapses many duplicates so a DAST run of 121 becomes 89 (≈25% fewer items). Correlation consolidates hundreds of SAST/DAST/IAST entries into a few dozen actionable issues and provides trace-from-source details to speed triage and verify fixes.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:41Why adding IAST?
- 3:08Auto Correlations - Goal
- 4:55OWASP Benchmark - Context
- 6:47OWASP Benchmark - Process
- 8:49OWASP Benchmark - Results
- 14:30Pulling the Curtain
- 19:29OWASP Benchmark - The Report
related talks
25mHow to select between SAST, DAST, IAST, RASP, and AST
22mSecurity for Developers
33mUsing IAST to Unlock the Benefits of DevSecOps
43mDevSecOps on steroids - Powered by your Selenium tests
21mAdding DAST to CI/CD, Without Any Losing Friends
49mMan vs Machine: manual and automated security testing
50mSAST'madness and Courage
51mThe great SAST dissonance: how to please every... (Claudio Merloni, Romain Gaucher)