Making Continuous Security a Reality with OWASP’s AppSec Pipeline
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 10:15· Westminster - 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Practical demonstration of an implemented pipeline that runs prebuilt docker containers for static and dynamic checks, pushes normalized results into OWASP Defect Dojo, and wires into CI hooks; the claim is reproducible automation rather than theory. The repo provides a spec and tools, an implementation called OWASP AppSec Pipeline, and measured runs like 36 repos in about three minutes plus an operational report of 15 repos 5,100 runs and 25,000 container executions.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:15Aaron Weaver
- 3:21Purpose the Purpose of an App Site Security Program
- 7:05What Is a Knapsack Pipeline
- 12:15Specification
- 13:00Sequence Diagram
- 19:39Named Pipeline
- 28:04Legacy Security Tools
- 29:07Manually Review and Tag Files from a Build
- 29:56Rules Engine
- 31:03Scanner Matching
- 31:32Iceberg of Ignorance
- 38:53Can You Run a Pipeline on Top of Kubernetes
related talks
43mBuilding a Secure DevOps Pipeline
36mCreating an AppSec Pipeline with Containers in a Week
45mLessons From DevOps: Taking DevOps Practices Into Your AppSec Life
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
45mAutomated Security Testing in a DevOps world
30mSecuring DevOps using OWASP DevSecOps Tools
37mA Secure Continuous Delivery Pipeline
46mBuilding An AppSec Pipeline: Keeping Your Program, And Your Life, Sane