By: Harinee Muralinath, Practice Lead - Security, ThoughtWorks India Learn practices and tools that help you move towards a "left-shift” in Application Security, through an approach that starts with a basic continuous feedback cycle. Includes code demos. Watch the recording of the Live session: https://www.facebook.com/ThoughtWorks/videos/1725418087481775/

1. Application Security
An Easy Start
#TalkTechToHer

2. Static Application Security Testing (SAST)

3. SAST
● Code-level analysis
● Language-specific
● Resources:
○ https://www.owasp.org/index.php/Source_Code_Analysis_Tools
○ https://github.com/mre/awesome-static-analysis
● OWASP Benchmark project to measure your tool

4. Dependency Check

5. Dependency Check
● Find vulnerable libraries and transitive dependencies
● (OWASP Top 10) A9 – Using components with known vulnerabilities
○ Prevalence: Widespread
○ Detectability: Difficult
● Resources:
○ JAVA, .NET: OWASP Dependency Check [also Jenkins plugin, experimental support for Ruby,
Python, Node]
○ Ruby: Bundler-Audit, Brakeman
○ JS, Node: Retire.js, Node Security Project
○ Python: requires.io
● Canary builds

6. App Secrets Management

7. Application Secret Management
● Potential SSH keys, authorization tokens, private keys etc
● Pro-active hooks
● Reactive scans
● Resources:
○ Talisman
○ Gitrob
○ Hawkeye

8. Dynamic Application Security Testing (DAST)

9. DAST
● Vulnerability scanners
● Attacker’s perspective
● Black-box test
● Resources:
○ Zed Attack Proxy
○ BurpSuite

10. Proactive controls/
Application Security Verification Std. (ASVS)
Functions

11. Proactive Controls
● Techniques/controls for secure development
● Resources:
○ OWASP Proactive Controls
○ OWASP ASVS

12. Cheers!
Harinee Muralinath
harineem@thoughtworks.com

13. BSI - Build Security In
Deploy and Release
Pen Testing, certification
Automated Checks
Access Controls
Server side DOS
prevention

14. Presented as part of
#TalkTechToHer
thoughtworks.com/talktech