How to get the best AppSec test of your life
summary
Opt for a transparent box test: hold a scoping meeting with devs/architects, ask for an example report, and give source access so testers tailor payloads instead of brute forcing. White‑listing the tester through the WAF, using a non‑production environment, and prefixing known issues saves time. Send progress as status plus critical findings only, then retest fixes and get tester help on mitigations (goal‑based checks, zero‑day impact, CI unit tests).
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:04What is an AppSec Test?
- 1:53What is the Best?
- 4:54Three opportunities
- 5:35The most transparent box
- 6:48Choosing the right tester
- 7:51An expert comes from outside
- 13:53Hack yourself first
- 14:13Opening up the product backlog like...
- 14:25Disclose known vulnerabilities
- 15:02Security by non-testability
- 17:33The testing setup
- 19:44Progress reports
- 21:44Executive Summary
- 23:04Well explained and actionable findings
- 24:07Prioritised action plan
- 25:44Assistance with fixes
- 27:31Key takeaways
related talks
37mHow to get developers to want to adopt AppSec
44mApplication Security: Everything we know is wrong
43mSecurity Testing Tools: Can I Touch You There?
48mAppSec++ Take the best of Agile, DevOps and CI/CD into your AppSec Program
01h 04mTransformation Blueprint for Developer-Centric Application Security
37mDeploying Security Testing Practice in Your Team and Company
27mHow to Start Security Testing Without Fear
26mBeyond Testing: Application Security in the Age of DevOps