Jumpstarting Your DevSecOps Pipeline with IAST and RASP
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 15:30· Westminster- 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims a working pipeline using free Community Edition IAST and RASP, where an IAST agent jar added to the app instruments code at runtime and reports real exploit paths (e.g., confirms SQL/Hibernate injection, shows line numbers), library inventory highlights that 71% of library code never runs and apps average ~26.7 custom-code vulnerabilities, and RASP blocks exploits in production (including deserialization and SQLi) with microsecond overhead while integrating into IDEs, CI/CD, JIRA and Slack.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:10start out with a couple of facts
- 13:05start in development
- 14:15give instant feedback through the tools that are already using and then scale
- 27:37respond to new vulnerabilities
- 29:22manage security policy across all of your applications
- 30:16run my test cases
- 32:48add the jacoco agent to the jar
- 38:42maintain database integrity
related talks
33mUsing IAST to Unlock the Benefits of DevSecOps
43mDevSecOps on steroids - Powered by your Selenium tests
25mHow to select between SAST, DAST, IAST, RASP, and AST
49mFixing the Unfixable: Solving Pervasive Vulnerabilities with RASP
52mApplication Security at DevOps Speed and portfolio scale
20mAI-Driven Security as Code in Jenkins
01h 18mDevSecOps - Automating Security in DevOps
45mLeveraging Projects and Tools to Transform Your SDLC