Difference between revisions of "OWASP AppSec DC 2012/Dynamic DASTWAF Integration"

Revision as of 20:55, 2 March 2012 (view source) Mark.bristow (talk | contribs) (Created page with "<noinclude>{{:OWASP AppSec DC 2012 Header}}</noinclude> __NOTOC__ == The Presentation == rightThe concept of dynamic application scanning test...")		Revision as of 04:40, 10 March 2012 (view source) Dallendoug (talk | contribs) (added bio) Newer edit →
Line 5:		Line 5:
	== The Speakers  ==		== The Speakers  ==
	Ryan Barnett		Ryan Barnett
		+
		+	Ryan C. Barnett is a senior security researcher on Trustwave's SpiderLabs Research Team where he specializes in web application defense.  He is a SANS Institute certified instructor and a member of both the Top 20 Vulnerabilities and CWE/SANS Top 25 Most Dangerous Programming Errors teams. In addition to working with SANS, he is also a WASC Member where he leads the Web Hacking Incidents Database (WHID) and Distributed Web Honeypots Projects and is also the OWASP ModSecurity Core Rule Set (CRS) project leader. Mr. Barnett has also authored a Web security book for Addison/Wesley Publishing entitled Preventing Web Attacks with Apache.
		+	Twitter account - @ryancbarnett
	<noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>		<noinclude>{{:OWASP AppSec DC 2012 Footer}}</noinclude>

---

Revision as of 04:40, 10 March 2012

Registration Now OPEN! | Hotel | Schedule | Convention Center | AppSecDC.org

The Presentation

The concept of dynamic application scanning testing (DAST) exporting data that is then imported into a web application firewall (WAF) for targeted remediation is not new. While this concept is certainly attractive to show risk reduction and reducing the time-to-fix metric, it is important to realize that you are not constrained to a "one way" data flow. WAFs have access to a tremendous amount of information that it can share with DAST to aid in application coverage and initiating on-demand assessments of new or change resources. This presentation will highlight how DASTs and WAFs can achieve a synergistic effect by dynamically sharing data. During the presentation, a working integration between the Arachni web application security scanner framework and the ModSecurity web application firewall will be presented.

The Speakers

Ryan Barnett

Ryan C. Barnett is a senior security researcher on Trustwave's SpiderLabs Research Team where he specializes in web application defense. He is a SANS Institute certified instructor and a member of both the Top 20 Vulnerabilities and CWE/SANS Top 25 Most Dangerous Programming Errors teams. In addition to working with SANS, he is also a WASC Member where he leads the Web Hacking Incidents Database (WHID) and Distributed Web Honeypots Projects and is also the OWASP ModSecurity Core Rule Set (CRS) project leader. Mr. Barnett has also authored a Web security book for Addison/Wesley Publishing entitled Preventing Web Attacks with Apache. Twitter account - @ryancbarnett

---

Gold Sponsors
Silver Sponsors
Small Business
Exhibitors