Dan Cornell - Hybrid Analysis Mapping Making Security and Development Tools Play Nice Together
Channel: OWASP Foundation
Date: 2014-07-02

AppSecEU 2014 in Cambridge
https://2014.appsec.eu/

Developers want to write code and security testers want to break it and both groups have specialized tools supporting these goals. The problem is -- security testers need to know more about application code to do better testing and developers need to be able to quickly address problems found by security testers. This presentation looks at both groups and their respective toolsets and explores ways they can help each other out. 

Two different interactions are examined: 
• How can knowledge of code make application scanning better? 
• How can application scan results be mapped back to specific lines of code? 

Using open source examples built on OWASP ZAP, ThreadFix and Eclipse, the presentation walks through the process of seeding web applications scans with knowledge gleaned from code analysis as well as the mapping of dynamic scan results to specific line of code. The end result is a combination of testing and remediation workflows that help both security testers and software developers be more effective. Particular attention is give to Java/JSP applications and Java/Spring applications and how teams using these frameworks can best benefit from these interactions.
Speakers

Dan Cornell
CTO, Denim Group
Dan Cornell has over twelve years of experience architecting and developing web-based software systems. He leads Denim Group's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. | | Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and currently serves as the OWASP San Antonio chapter leader, member of the OWASP Global Membership Committee ..

-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project