Automating Security Tests in Development with Docker
•
0 gostou•8 visualizações
This talk provided an introduction to testing web applications using readily-available docker images. Slides were paired with live demos of the tools covered.
Recomendados
Recomendados
Mais conteúdo relacionado
Semelhante a Automating Security Tests in Development with Docker
Semelhante a Automating Security Tests in Development with Docker (20)
Mais de Gabriel Schuyler
Mais de Gabriel Schuyler (11)
Último
Último (20)
Automating Security Tests in Development with Docker
- 1. Gabe Schuyler @gabe_sky LASCON 2022 Automating security tests in development with Docker (an introduction)
- 2. Gabe Schuyler LASCON 2022 @gabe_sky Who am I? Gabe Schuyler • Operations • Cybersecurity • Dev(Sec)Ops • Now: Wiz, Inc. • Past: Palo Alto Networks, PuppetLabs, Sony Playstation ...
- 3. Gabe Schuyler LASCON 2022 @gabe_sky Why bother? framing the problem • Use the same tools as attackers • An ounce of prevention • Shift-left • Developers know what to double-down on in an attack • Continuously shifting attacks -- don't just scan once and forget it • Avoid gating before production • Pen tests take weeks, a Docker run takes seconds
- 4. Gabe Schuyler LASCON 2022 @gabe_sky Containers in a very small nutshell • Tiny • Prepackaged • Single purpose • Virtual machines
- 5. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms apps tools games kernel
- 6. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms apps tools games kernel app fi les ports
- 7. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down • Overview • Images • Volumes • Ports • Web apps • Attack platforms kernel app fi les ports
- 8. Gabe Schuyler LASCON 2022 @gabe_sky Docker in a nutshell shrinking it down kernel attack fi les ports web server • Overview • Images • Volumes • Ports • Web apps • Attack platforms
- 9. Gabe Schuyler LASCON 2022 @gabe_sky Readme.txt relax, it's all here • Requirements • Commands to run • We're trying to help • "Pull requests welcome!"
- 10. Gabe Schuyler LASCON 2022 @gabe_sky Caveat haX0r you break it you bought it • Virtualize • Snapshot • Embrace destruction
- 11. Gabe Schuyler LASCON 2022 @gabe_sky Launching broad attacks it's not just for script kiddies • ZAProxy • nikto • Ask your developers what to try!
- 12. Gabe Schuyler LASCON 2022 @gabe_sky Application-specific attacks know your enemy • wpscan • SQLmap
- 13. Gabe Schuyler LASCON 2022 @gabe_sky Fuzzing what's that you say? • ff uf • wfuzz • API security
- 14. Gabe Schuyler LASCON 2022 @gabe_sky General purpose toolkits generic linux as a container • Kali • Some assembly required • Versatile • Docker fi les and layers
- 15. Gabe Schuyler LASCON 2022 @gabe_sky Continuous attack in the software lifecycle • Research • Development • Deployment • Production • Share results • Borrow knowledge
- 16. Gabe Schuyler LASCON 2022 @gabe_sky Where to start danger is my middle name • Web application • Basic attacks • Get fancy • Integrate into CICD • Integrate into monitoring
- 17. Q & A and Discussion Gabe Schuyler @gabe_sky LASCON 2022