Using IAST to Unlock the Benefits of DevSecOps • Jeff Williams • YOW! 2022
This presentation was recorded at YOW! 2022. #GOTOcon #YOW
Jeff Williams - CTO & Co-founder at Contrast Security @ContrastSecurity
RESOURCES
ABSTRACT
The complexity of modern applications and APIs makes them extremely difficult to test for security vulnerabilities. Traditional tools like static (SAST) and dynamic (DAST) scanners are complex to run and produce far too many false positive and false negative results. This inevitably leads to siloed appsec testing teams, bottlenecks, long feedback loops, and large security backlogs.
Fortunately, there’s a way out of this trap. Using interactive application security testing (IAST), we can get inside the running application and directly measure security. Anyone who can use a browser can find complex, critical vulnerabilities without scanning, without security expertise, and without changing anything about their development process. IAST runs in real time and merges highly accurate security testing into all your normal QA activity. In this talk, you’ll learn how IAST works and how it can unlock the benefits of DevSecOps.
Jeff will share data showing how large real-world companies have transformed their application security programs, eliminated their security backlog, slashed their mean time to remediate vulnerabilities, and cut their new vulnerability rate. And more importantly, they’ve merged their quality and security testing infrastructures and aligned the interests of the development and security teams. These organizations are getting secure code moving and delivering value to customers at high velocity. [...]
TIMECODES
00:00 Intro
02:04 Public expectations don’t match reality
05:04 DevSecOps will fix everything
08:37 Instrumentation changes everything
12:10 Example: Detecting SQL injection
13:45 IAST
17:42 Runtime vulnerability snapshots
19:09 Runtime library analysis
21:07 Runtime route coverage
23:13 Runtime architecture diagrams
24:50 Deploying IAST at scale
25:55 DevSecOps - Getting secure code moving
29:33 Metrics that matter
32:53 Outro
Download slides and read the full abstract here:
RECOMMENDED BOOKS
Liz Rice • Container Security •
Liz Rice • Kubernetes Security •
Aaron Parecki • OAuth 2.0 Simplified •
Aaron Parecki • OAuth 2.0 Servers •
Aaron Parecki • The Little Book of OAuth 2.0 RFCs •
Erdal Ozkaya • Cybersecurity: The Beginner’s Guide •
Richer & Sanso • OAuth 2 in Action •
#DevSecOps #IAST #Security #ContrastSecurity #JeffWilliams #SAST #DAST #appsec
Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket at
Sign up for updates and specials at
SUBSCRIBE TO OUR CHANNEL - new videos posted almost daily.
1 view
0
0
1 month ago 00:09:32 1
🔔Приказ от Бога нам - оставить всё и пойти быть с царём❗ #последнийправославныйцарь #пророчества
1 month ago 00:06:47 1
Indifferent Guy – Stardust (Original Mix) [Lowbit]
1 month ago 00:46:59 1
Leather Kentucky Backpack DIY
1 month ago 01:59:13 1
S4E73 | Jennifer Guskin - MK ULTRA & Sex Trafficking Survivor on Epstein, CPS & Witnessing Blackmail
1 month ago 00:05:03 1
🕊️Сохранить себя в Истине! ☦️ Живой Бог -Живые Люди!!!
1 month ago 00:10:34 1
The Destructive Power Of Lennox Lewis
1 month ago 00:07:04 1
Красиво отправил “СУДЬЮ“ в нокаут👊 Кто дал вам право нас умерщвлять⁉️
1 month ago 00:40:56 1
Массовый выход из РПЦ МП необходим. Державный Патриарх Зосима.
1 month ago 00:09:15 1
🔥Казнь 4-я❗ Наказание песьими мухами🪰
1 month ago 00:00:38 1
Runway Gen-3 vs Kling AI - and the winner is...
1 month ago 00:00:53 2
Luma AI vs Runway Gen-3 vs Kling AI: There can only be one 🎥🥇🥈🥉
1 month ago 00:06:40 1
Rises 146 Passages! New Mercedes-Benz eCitaro (2025)perfectly suited for everyday use
1 month ago 00:03:09 1
~In my Bones~ Simba x Kovu I
1 month ago 00:25:00 1
PADLOCKED home was left TOO LONG and this is what it turned into
1 month ago 00:03:42 1
Daisy Gray - Wicked Game (Official Tribute Video)
1 month ago 00:45:04 1
The Return of the Anunnaki Movie | Ancient Gods Return
1 month ago 00:11:02 1
Top 10 Offline Mobile RPGs of 2024! NEW GAMES REVEALED for Android and iOS
1 month ago 00:02:38 1
SHE - Elvis Costello (Lyrics) Cover Cello by HAUSER
1 month ago 00:03:25 1
My Chemical Romance - The Ghost Of You [Official Music Video]
1 month ago 00:19:58 1
Is Jared Kushner the Jewish Messiah or Sudden Destruction is waiting ahead?
1 month ago 00:11:48 1
«Погублю мудрость мудрецов, и разум разумных отвергну».1 Коринф. 1:19⚜Слово Державного Зосимы.
1 month ago 00:10:30 1
“Откуда БЛУД духовный и телесный?“ ⚜Слово Державного Патриарха Зосимы.