BSidesATL 2020 - Detect: Automated Web Application & API Discovery & Other Things That Sound Simple
Channel: BSidesATL
Date: 2020-04-17

Building an application inventory is a critical but often skipped step in many Application Security programs. Security teams are overly dependent on questionnaires, word of mouth or other passive methods of application discovery. This can create gaps which are filled with unknown, legacy or otherwise risky applications in the environment. These neglected areas then become a perfect foothold for an attack. In this talk we will dissect the challenges around web application and API discovery, and outline approaches that have worked well for our team. We will outline specific techniques for automatically enumerating web applications and APIs and onboarding them into tools that can help identify risk.
Jeremy is an Information Security Architect at a Fortune 1000 retailer. His responsibilities include penetration testing, security tools development, secure code review, secure architecture review and threat modeling.
Jeremy has experience in software development stretching back 20 years and his work has led to the publication of 8 peer-reviewed papers and 5 patents.
His previous roles include web security researcher, developer and software development manager for HP WebInspect. His notable contributions include building the WebInspect REST API, adding support for GWT, and authoring the WebInspect plugin for Burp Suite. Prior to joining HP, Jeremy held lead developer roles at several small startups. 

Stuart Lane