Rollercoaster of Security Automation
summary
Claim: an open‑source security test automation platform that converts noisy scanner output into actionable issues. Uses SonarQube and SpotBugs for static scans, ZAP/Nikto/Qualys/Arachne (and optional Burp) for dynamic scans, Jenkins/JUnit/JIRA for pipeline and ticketing, and ReportPortal plus an equals analyzer for false‑positive filtering. Scanners produce ~85% false positives and 68% of effort is validation; grouping and an outcome filter reduce 24k hits to five so teams fixable; running functional automation through a proxy cuts dynamic scan time from ~20 hours to ~25 minutes and finds real SQLi and reflected XSS rather than noise.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:06Theory
- 4:02Scanning
- 6:50Security Specialist
- 7:22Market
- 8:57Plan
- 10:31Experiments
- 15:26Enterprise level integration
- 17:42Data model
- 19:49Deduplication
- 21:13Filtering
- 26:28Dynamic Scanning
- 28:26External Intrusion
- 29:59Functional Automation
- 30:52Results
- 33:57Open Source
- 35:12Demo
- 35:52Demo code
related talks
40mAutomation of Security Scanning: Easy or Cheese
09mAutomated Application Security Testing
46mSecurity DevOps - Staying Secure In Agile Projects
39mAutomating Your Security Checks: Stop Hiding Your Flaws Next to the Monsters...
46mMaking Security Agile
52mApplication Security at DevOps Speed and portfolio scale
01h 01mOpen Source Pentesting and Security Analysis Tools: the DevOps way… #slideless
47mAutomated Security Scanning in Payment Industry