We all know that running security tests on a CI can gives us a lot of value. And we all know already a few good security tools that we are running or planning to run continuously to ensure our app stays secure. But integrating those tools into the CI is not a simple task. Each one of those tools has it's own API and does not always support all the features we want. For example, we might want to report the finding of each tools as TeamCity tests, or maybe we are using Jira and want to open a new issue for each finding. And what about filtering false positives? Any automated tool will produce false positive findings, but how can we filter them? In this talk I'll demo OWASP Glue - a tool that aims to ease the integration of various security tools into the CI/CD pipeline. The talk was presented on DevSecOps meetup

1. OWASP Glue
@omerlh
#MeetupAtSoluto
April 2018

2. Why another security tool?

3. Story Time

7. https://www.slashgear.com/petya-ransomware-finally-has-a-fix-no-need-to-pay-ransom-12435885/

8. I should’ve read that report...

9. Let’s add some Glue

10. OWASP Glue
● Ease the integration of secure tools
● ”DevSecOps Tool”
● OWASP Open Source Project

11. Task Target Findings

12. Findings Filter Report

13. Currently Supported Tasks
● brakeman
● bundleaudit
● checkmarx
● clamav
● dawnscanner
● eslint
● fim
● findsecbugs
● nsp
● owasp-dep-check
● pmd
● retirejs
● scanjs
● sfl
● sync
● snyk
● OWASP zap

14. Running Glue
OmerL-Mac$ docker run -it soluto/glue:17 glue -h

15. ”DevSecOps tool”
● Quick win
● Break the build or it doesn’t happen
● Handling false positive
● Keep it DRY

17. Example from our production TeamCity

18. Wrap Up
● OWASP Glue
● ”DevSecOps tool”
● Using Glue

19. What Glue can do for YOU?
@omerlh

20. Moment for Gratitude
● Matt Konda
● Alex Lock
● Rafa Perez

22. Acknowledgment
● Glue is an OWASP project
● Not active in the past year
● Temporary Maintained by Soluto (fork)
● Actively used by Soluto
● Hope to merge back to master

23. Now You Can Rest

24. Questions?

25. Thank You
@omerlh
#MeetupAtSoluto