[Russia] Building better product security
โข
1 likeโข383 views
Building better product security: an engineering approach. Taras Ivashchenko.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (12)
Similar to [Russia] Building better product security
Similar to [Russia] Building better product security (20)
More from OWASP EEE
More from OWASP EEE (20)
Recently uploaded
Recently uploaded (20)
[Russia] Building better product security
- 1. Taras Ivashchenko Building better product security: an engineering approach
- 2. /me โ Product security team lead at Yandex โ OWASP Russia chapter board member โ ยซSome thoughts on web securityยป https://oxdef.info
- 3. The problem The faster you release new features for users the better service you have Product Security: how to be a bottle opener, not a bottleneck Mortal Kombat, Warner Bros. Interactive Entertainment
- 4. The Security Development Lifecycle https://msdn.microsoft.com/library/cc307406
- 8. Product security team duties โ Trainings โ Architecture consultations โ Security audits โ Bug bounty manage & response โ Develop and deploy security tools & controls โ Checklists, policies and security knowledge base โ R&D โ Other projects
- 9. Faster! Whiplash, 2014, Damien Chazelle, Sony Pictures Classics
- 11. Molly
- 12. Molly โ Web application security scanning solution โ Rest API & web interface โ Integrated with internal tools: QA framework Aqua, CI, bug tracker โ Python, Celery and Django inside โ w3af as scanner โ Used by QA and security team
- 13. Crasher โ Younger brother of Molly โ Testing of production environment โ Find all our web services and scan it for security issues โ Optimized to scan large number of targets โ Mostly for system administrators
- 14. CAT โ Static Application Security Testing (SAST) โ Checkmarx and Coverity โ Integrated into CI โ API โ Mostly for developers
- 15. Vulnman โ Notification robot โ Python (yes, we like it :) โ Unresolved critical issues โ Daily digest โ Monitor 3rd party CVEs
- 16. Ampelmann
- 17. Ampelmann โ Help to keep an eye on things โ Help to improve security processes โ Get security related information from multiple sources via APIs โ Show various lists, graphics and diagrams โ Python, Flask, Mongo
- 18. Summary โ Automate everything as much as possible โ Measure and improve security processes โ It is not for removing manual activities! It frees up time for more complex things (which we really like to do).
- 19. Thank you!