End-to-end solution which provides recommendations and analysis data to solve challenging problems.

1. 1
Skype: florykian.karen EPAM Kharkiv
Security
Automation
Easy or cheese
by Karen Florykian
Lead Performance Analyst

2. 2
Application Security Testing
Security assessment for routers,
firewall, load balancers, switches,
find network misconfiguration
Infrastructure Scanning
OS vulnerabilities, known
vulnerabilities in images, evaluate
the image against policies to check
for security compliance.
Container Scanning
Dynamic application security testing
Find security vulnerabilities in a running
application, typically web apps.
DAST
Static Application Security Testing
Catch security issues on early stages
of code development, allows
developers to find bugs in code
SAST
Many types of security vulnerabilities are difficult to
find automatically, such as authentication problems,
access control issues, insecure use of cryptography,
etc.
Functional Security Automation

3. 3
Security Automation
03
01
04
02
Speed
Integrity
Availability
Visibility

4. 4
Real Life
68 %
False positive analysis
25 %
29 % 39 %
7 %

5. 5
Real Life
85 %
of findings are
not real issues
25 %
29 % 39 %
7 %

6. 6
Vision

7. 7
Proof Of Concept
• Integrated in existing CI pipeline
or configured to be ran on self-
service basis
• Traffic created using existing
tests
• False Positives analysis can be
partially automated using DefectDojo
or ReportPortal capabilities

8. 8
Project Pipeline

9. 9
Under The SAST Hood

10. 10
Grouping
Jira service
ReportPortal
Jira Service
Junit XML

11. 11
Spidergetti Or Rainboweb
Jira service
ReportPortal
Jira Service
Junit XML

12. 12
Canonical Data Model
Jira service
ReportPortal
Jira Service
Junit XML
CDM

13. 13
Auto-Analysis
• Validate capabilities
• Identify parameters to reduce duplicates
• Create service with equals strategy
• Contact to ReportPortal team to create
custom analyzer service with equals
strategy

14. 14
Issue #1

15. 15
Issue #2

16. 16
We All Are Lazy
VS
OPEN FOR WEEKS
BECAUSE IT IS
NOT ACTIONABLE
FIXED WITHIN
THE WEEK IT
APPEARED IN BACKLOG

17. 17
Carrier
carrier-io/sast: Tools for SAST
Demo

18. 18
Useful Links
• SAST: https://github.com/carrier-io/sast
• Docker Hub: https://hub.docker.com/r/getcarrier/sast
• DAST: https://github.com/carrier-io/dast
• Docker Hub: https://hub.docker.com/r/getcarrier/dast
• DASTY : https://github.com/carrier-io/dusty Library to execute various
security tools and convert output to common unified format
• Carrier: https://hub.docker.com/u/getcarrier
• ReportPortal Auto-Analysis equals service:
https://github.com/reportportal/service-analyzer-equals

19. 19
Thank You!Florykian Karen
Lead Performance Analyst