Start writing security tests now!
summary
Argues developers must add concrete security tests into CI/CD now, showing tools and failures: an unsecured Elasticsearch exposes 430 GB of data, ZIP extraction allows path traversal, a consumer "ski helmet" API leaks user emails and bcrypt digests, and XML XXE via Jackson happens because default XMLMapper is unsafe. Recommends starting with OWASP ASVS level 1, run SAST, DAST (ZAP/arachne), dependency scanners and IAST agents in the pipeline so common issues are caught automatically and pen tests find only real, complex problems.
AI-written summary · about
chapters (22)
- 0:00Intro
- 3:10Agenda
- 7:50Motivation for working in security
- 11:07Security and developers working together
- 15:45How to start
- 17:59ASVs
- 19:47Hockney Scanner
- 21:33Code Review
- 24:55Why Code Refuses
- 29:06Use Functional Test Cases
- 30:43BehaviorDriven Development
- 31:28BDD Security
- 32:57Static Application Security
- 33:11Strengths
- 33:32Weaknesses
- 34:02Dynamic Application Security Testing
- 34:48Limitations
- 35:25Interactive Security Testing
- 36:46Pen Test
- 37:43Pull Request
- 38:05Pen Tester
- 38:41Conclusion
related talks
06mInterview with
27mHow to Start Security Testing Without Fear
57mThe Developer's Field Guide to Software Security
57mShift Left Security with the Security Test Pyramid
37mDeploying Security Testing Practice in Your Team and Company
44mShift-Left-Security with the Security Test Pyramid
26mBeyond Testing: Application Security in the Age of DevOps
29mSecuring Your Web Application Pipeline From Intruders