Application Security Resources

Sub Text of Application Security Resources

Interactive Application Security Testing (IAST), Beyond SAST/DAST

October 9, 2012

Tiny Url for this post: http://tinyurl.com/ntazcne

Speaker: Ofer Maor, CTO Quotium and Chairman, OWASP Israel & Global Membership Committee, OWASP
Presented in: OWASP AppSec EU, October 2012, Athens, Greece

Until recently, SAST/DAST dominated the application security testing market, each with its own pros and cons. We present IAST, a completely new approach – analyzing code execution, memory and data in runtime, allowing for accurate inspection of the application. We will discuss IAST technology (introduced into the 2011 Hype Cycle) compared with DAST/SAST, and the benefits it provides. The goal of the talk is to examine and discuss technological concepts rather than specific products or solutions, and includes a technical drill-down into the technology specifics.

The talk will begin by presenting the standard IAST building blocks and their benefits, and continue by showing advanced IAST data analysis capabilities, which allow for a deeper analysis of the application and its business logic. The presentation will include practical samples (including code!) of how IAST can be used to accurately detect both simple and complicated vulnerabilities, including SQL Injection, Parameter Tampering, Persistent XSS, CSRF, and more…

This post is also available in: Anglais

Learn more about Seeker

More Autres Ressources