Bhushan Gupta

Beating the Clock using AppSec Testing Tools and DevSecOps

With the rising number of security breaches, the IT industry is facing increasing pressure every day to develop more secure and robust web applications. The applications are developed in a complex environment involving frameworks, languages, and platforms and are often deployed in even more diverse hosting conditions. Industry’s appetite to first-to-market makes matters worst. The software industry has heavily leveraged automation to improve quality and beat the time-to-market clock. Web application security tools are now gaining momentum.

This presentation will focus on how the application security (AppSec) test tools can be utilized to develop a more secure product and gain development efficiencies. It will first layout tool selection criteria and then discuss the strengths and shortcomings of both static and dynamic test tools. The presentation will showcase the ZAP (Zed Attack Proxy), a widely used OWASP (Open Web Application Security Project) tool, highlighting its strengths. The presentation will also feature a demo of ZAP, both as a standalone tool and as its integrated form with the CI/CD pipeline with Jenkins.

Learning objectives:

• How to select an AppSec testing tool

• ZAP – strengths and usage

• How to run ZAP as a standalone tool

• How to integrate ZAP with Jenkins