OWASP AppSec DC 2012/Dynamic DASTWAF Integration - Revision history

Mark.bristow at 01:01, 12 March 2012

2012-03-12T01:01:37Z

Dallendoug: added bio

2012-03-10T04:40:24Z

added bio

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} NOTOC == The Presentation == rightThe concept of dynamic application scanning test..."

2012-03-02T20:55:31Z

Created page with "<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude> __NOTOC__ == The Presentation == rightThe concept of dynamic application scanning test..."

New page

<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude>
__NOTOC__
== The Presentation ==
[[Image:Owasp_logo_normal.jpg|right]]The concept of dynamic application scanning testing (DAST) exporting data that is then imported into a web application firewall (WAF) for targeted remediation is not new. While this concept is certainly attractive to show risk reduction and reducing the time-to-fix metric, it is important to realize that you are not constrained to a "one way" data flow. WAFs have access to a tremendous amount of information that it can share with DAST to aid in application coverage and initiating on-demand assessments of new or change resources. This presentation will highlight how DASTs and WAFs can achieve a synergistic effect by dynamically sharing data. During the presentation, a working integration between the Arachni web application security scanner framework and the ModSecurity web application firewall will be presented.
== The Speakers ==
Ryan Barnett
<noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

@@ Line 2: / Line 2: @@
 __NOTOC__
 == The Presentation  ==
-[[Image:Owasp_logo_normal.jpg|right]]The concept of dynamic application scanning testing (DAST) exporting data that is then imported into a web application firewall (WAF) for targeted remediation is not new.  While this concept is certainly attractive to show risk reduction and reducing the time-to-fix metric, it is important to realize that you are not constrained to a "one way" data flow. WAFs have access to a tremendous amount of information that it can share with DAST to aid in application coverage and initiating on-demand assessments of new or change resources.  This presentation will highlight how DASTs and WAFs can achieve a synergistic effect by dynamically sharing data.  During the presentation, a working integration between the Arachni web application security scanner framework and the ModSecurity web application firewall will be presented.
+The concept of dynamic application scanning testing (DAST) exporting data that is then imported into a web application firewall (WAF) for targeted remediation is not new.  While this concept is certainly attractive to show risk reduction and reducing the time-to-fix metric, it is important to realize that you are not constrained to a "one way" data flow. WAFs have access to a tremendous amount of information that it can share with DAST to aid in application coverage and initiating on-demand assessments of new or change resources.  This presentation will highlight how DASTs and WAFs can achieve a synergistic effect by dynamically sharing data.  During the presentation, a working integration between the Arachni web application security scanner framework and the ModSecurity web application firewall will be presented.
 == The Speakers  ==
-Ryan Barnett
+<table>
+<tr>
-Ryan C. Barnett is a senior security researcher on Trustwave's SpiderLabs Research Team where he specializes in web application defense.  He is a SANS Institute certified instructor and a member of both the Top 20 Vulnerabilities and CWE/SANS Top 25 Most Dangerous Programming Errors teams. In addition to working with SANS, he is also a WASC Member where he leads the Web Hacking Incidents Database (WHID) and Distributed Web Honeypots Projects and is also the OWASP ModSecurity Core Rule Set (CRS) project leader. Mr. Barnett has also authored a Web security book for Addison/Wesley Publishing entitled Preventing Web Attacks with Apache.
+<td>
 Twitter account - @ryancbarnett
 <noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

OWASP AppSec DC 2012/Dynamic DASTWAF Integration - Revision history

Mark.bristow at 01:01, 12 March 2012

Dallendoug: added bio

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} __NOTOC__ == The Presentation == rightThe concept of dynamic application scanning test..."

Mark.bristow: Created page with "{{:OWASP AppSec DC 2012 Header}} NOTOC == The Presentation == rightThe concept of dynamic application scanning test..."