Evolution of AppSec: Perspectives from a Decade of Building OWASP ZAP
summary
OWASP ZAP is an Apache‑2 open source web app scanner developed over a decade with concrete outputs: daemon mode and API (2011) for automation, WebSocket and Ajax Spider support (2013), Docker images (2016), heads‑up display (2019), and GitHub Actions plus GraphQL and an automation framework (2020). The project runs weekly releases since 2012, spans ~35 GitHub repos, claims to be the most frequently used web application scanner, and even shows bizarre usage spikes like 6 million Docker pulls in February 2021 versus 1M in March.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:14Overview
- 0:59What is ZAP?
- 9:45ZAP 1.2.0 Screenshot 1.0.0 Screenshot (hacked)
- 10:23ZAP History - Firsts and Innovations (1/2)
- 14:33ZAP Today
- 16:07Running a Successful Open Source Project
- 19:05Wearing Many Hats
- 20:07Measure Everything You Can
- 23:00Getting Contributors
- 24:03Student Hall of Fame
- 24:44Getting Sponsorship
- 26:21Innovations Vs Evolution
- 27:41Ongoing Challenges
- 29:00AppSec Changes in the Last 10 Years
- 30:43Where We Stand Today
- 33:17The Future of AppSec
- 34:54A Blended Approach to Security
- 36:49The Future of ZAP
- 37:36Takeaways
related talks
45mSecurity Testing with OWASP ZAP in CI/CD
47mOWASP ZAP: More Advanced Features
58mWhiz, Bang, ZAP! An introduction to OWASP's Zed Attack Proxy
12mOWASP ZAP HUD WTF?
36mLet's take baby steps to security testing
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
52mApplication Security at DevOps Speed and portfolio scale
59mZAP Project