A new framework to automate MSTG and MASVS in your CI/CD pipeline
summary
Claims a working pipeline that automates MSTG and MASVS into BDD tests and integrates those tests into CI/CD with Jenkins and Docker. It actually wires UI automation (examples: uses Calabash Appium Drozer Needle ADB) to run feature files against emulators or real devices, runs logcat and sqlite queries to assert no sensitive data, and fails when issues appear — demos show failing log and database checks. A GitHub repo exists so teams can reuse and extend the framework.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:42Why does mobile security matter?
- 1:53Agile SDLC: where and when to detect vulnerabilities?
- 3:16Why do mistakes happen?
- 4:04Mobile Security challenges
- 5:18Introduce security integration tests
- 6:20Biggest problem with tests
- 6:34Solution: BDD
- 6:51BDD explained: features and steps
- 8:03Why BDD in security? Communication
- 8:38Cucumber: the king of BDD
- 9:09Translate the OWASP MSTG in BDD
- 9:40Automate the UI
- 10:08Execute security tests
- 10:35Get Feedback
- 10:46Full process in the SDLC
- 12:15Setup
- 12:44Target: OWASP MSTG Hacking Playground
- 13:08OWASP MSTG: Testing Logs for Sensitive Data
- 13:57BDD: Testing Logs for Sensitive Data
- 16:29OWASP MSTG: Testing Local Storage for Sensitive Data
- 17:15BDD: Testing Local Storage for Sensitive Data
- 17:47Reporting
- 18:32Integration in CI/CD
- 22:09Benefits
- 23:38References
related talks
36mSecurity Test Driven Development (STDD) Using Selenium/Appium
47mA universal pipeline for testing web applications using Docker
21mAutomate your work
36mTest Automation Architecture. Advanced Level
20mContinuous integration for mobile
23mGetting your automated tests in the pipeline
53mTransforming testing methodologies: From manual to robust strategies
49mUsing Jenkins for your DSC CI Pipeline