Description: The Presentation
The concept of dynamic application scanning testing (DAST) exporting data that is then imported into a web application firewall (WAF) for targeted remediation is not new. While this concept is certainly attractive to show risk reduction and reducing the time-to-fix metric, it is important to realize that you are not constrained to a "one way" data flow. WAFs have access to a tremendous amount of information that it can share with DAST to aid in application coverage and initiating on-demand assessments of new or change resources. This presentation will highlight how DASTs and WAFs can achieve a synergistic effect by dynamically sharing data. During the presentation, a working integration between the Arachni web application security scanner framework and the ModSecurity web application firewall will be presented.
The Speakers
Ryan Barnett
Ryan C. Barnett is a senior security researcher on Trustwave's SpiderLabs Research Team where he specializes in web application defense. He is a SANS Institute certified instructor and a member of both the Top 20 Vulnerabilities and CWE/SANS Top 25 Most Dangerous Programming Errors teams. In addition to working with SANS, he is also a WASC Member where he leads the Web Hacking Incidents Database (WHID) and Distributed Web Honeypots Projects and is also the OWASP ModSecurity Core Rule Set (CRS) project leader. Mr. Barnett has also authored a Web security book for Addison/Wesley Publishing entitled Preventing Web Attacks with Apache.
Twitter account - @ryancbarnett
Tags: securitytube , Confidence , hacking , hackers , information security , convention , computer security , owasp-12 , owasp-dc-2012 ,
Disclaimer: We are a infosec video aggregator and this video is linked from an external website. The original author may be different from the user re-posting/linking it here. Please do not assume the authors to be same without verifying.