SLSA - An End-to-End Framework for Supply Chain Integrity
•
0 likes•159 views
One of the biggest challenges for software developers is the need to make informed choices about the external software and products they use in their own software systems. Evaluating whether a given system is appropriately secured can be challenging, especially if it’s external or owned by a third party. This so-called software supply chain has been under increasing scrutiny in recent years, with attacks on software systems being responsible for damages to both public and private interests. In collaboration with the Open Source Security Foundation (OpenSSF), Google has proposed Supply-chain Levels for Software Artifacts (SLSA). The new SLSA framework formalizes criteria around software supply chain integrity, to help the industry and open-source ecosystem secure the software development lifecycle. SLSA (pronounced "salsa") is a security framework from source to service, giving anyone working with software a common language for increasing levels of software security and supply chain integrity. It’s how you get from safe enough to being as resilient as possible, at any link in the chain. This SlideShare explores the concept of SLSA in brief.
Report
Share
Report
Share
Recommended
Vulnerability assessment and penetration testing
This document discusses vulnerability assessment and penetration testing. It defines them as two types of vulnerability testing that search for known vulnerabilities and attempt to exploit vulnerabilities, respectively. Vulnerability assessment uses automated tools to detect known issues, while penetration testing employs hacking techniques to demonstrate how deeply vulnerabilities could be exploited like an actual attacker. Both are important security practices for identifying weaknesses and reducing risks, but require different skills and have different strengths, weaknesses, frequencies, and report outputs. Reasons for vulnerabilities include insecure coding, limited testing, and misconfigurations. The document outlines common vulnerability and attack types as well as how vulnerability assessment and penetration testing are typically conducted.
OWASP Risk Rating Methodology.pptx
Explain in Hindi: https://www.youtube.com/watch?v=6xqkDB3NHN0
Discovering vulnerabilities is important, but being able to estimate the associated risk to the business is just as important. Early in the life cycle, one may identify security concerns in the architecture or design by using threat modeling. Later, one may find security issues using code review or penetration testing. Or problems may not be discovered until the application is in production and is actually compromised.
Reference: https://owasp.org/www-community/OWASP_Risk_Rating_Methodology
https://www.owasp-risk-rating.com/
Malware analysis _ Threat Intelligence Morocco
The document discusses two cyber threats that existed in Morocco:
1. A password info stealer malware that was responsible for 90% of attacks. Intelligence tracking detected around 180GB of leaked data related to Moroccan domains and personal information, and over 320 spammers were identified from the data with connections to Morocco.
2. An ATM dispense malware that was gathered from Moroccan internet service providers. Technical details about the ATM malware were presented, but not summarized.
The document ends by stating that preparations are being made for the "next war", but does not clarify the purpose of the two threats.
Sharpening your Threat-Hunting Program with ATTACK Framework
From MITRE ATT&CKcon Power Hour December 2020
By Hieu Tran, Threat Detection Team Lead FPT Cybersecurity Division
No matter how sophisticated and thorough your security precautions may be, you cannot assume your security measures are impenetrable. This is why you need a threat hunting program in place. But how can we implement a proper threat hunting program and run it efficiently? In this talk, we will uncover how to sharpen your threat hunting strategy by leveraging ATT&CK. Ultimately, we’ll be demonstrating how effectively employing the hunting methodology in the real-world battlefield, fighting against well-known cyber espionage actors who strongly focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.
Software Composition Analysis Deep Dive
Software composition analysis (SCA) is often sold as an easy win for application security, but ensuring that we have full visibility on the vulnerable components is a lot more challenging that it looks. The remediation costs can also stack up pretty quickly as we try to get rid of deeply nested vulnerable transitive dependencies.
Owasp zap
This document discusses using the OWASP Zed Attack Proxy (ZAP) tool to find vulnerabilities in web applications. ZAP is a free and open-source web application penetration testing tool that can be used to conduct both automated and manual testing of applications. The document provides an overview of ZAP's features, how to install and configure it, how to test applications for vulnerabilities using both automated and direct methods, and how to integrate ZAP with other tools.
Vapt life cycle
1. Vulnerability assessment and penetration testing (VAPT) involves identifying security vulnerabilities in an organization's network and systems through scanning and manual exploitation techniques.
2. The process includes information gathering, scanning to detect vulnerabilities, analysis of vulnerabilities found, and penetration testing to manually exploit vulnerabilities.
3. The final report documents the findings by risk level, technical details of vulnerabilities discovered, and recommendations for remediation.
Malware analysis
- Malware analysis involves both static and dynamic analysis techniques to understand malware behavior and assess potential damage. Static analysis involves disassembling and reviewing malware code and structure without executing it. Dynamic analysis observes malware behavior when executed in an isolated virtual environment.
- Tools for static analysis include file hashing, string extraction, and PE header examination. Dynamic analysis tools monitor the registry, file system, processes, and network traffic created by malware runtime behavior. These include Process Monitor, Wireshark, Process Explorer, and network sniffers.
- To safely conduct malware analysis, one should create an isolated virtual lab separated from production networks, and install behavioral monitoring and code analysis tools like OllyDbg, Process Monitor, and Wiresh
Recommended
Vulnerability assessment and penetration testing
This document discusses vulnerability assessment and penetration testing. It defines them as two types of vulnerability testing that search for known vulnerabilities and attempt to exploit vulnerabilities, respectively. Vulnerability assessment uses automated tools to detect known issues, while penetration testing employs hacking techniques to demonstrate how deeply vulnerabilities could be exploited like an actual attacker. Both are important security practices for identifying weaknesses and reducing risks, but require different skills and have different strengths, weaknesses, frequencies, and report outputs. Reasons for vulnerabilities include insecure coding, limited testing, and misconfigurations. The document outlines common vulnerability and attack types as well as how vulnerability assessment and penetration testing are typically conducted.
OWASP Risk Rating Methodology.pptx
Explain in Hindi: https://www.youtube.com/watch?v=6xqkDB3NHN0
Discovering vulnerabilities is important, but being able to estimate the associated risk to the business is just as important. Early in the life cycle, one may identify security concerns in the architecture or design by using threat modeling. Later, one may find security issues using code review or penetration testing. Or problems may not be discovered until the application is in production and is actually compromised.
Reference: https://owasp.org/www-community/OWASP_Risk_Rating_Methodology
https://www.owasp-risk-rating.com/
Malware analysis _ Threat Intelligence Morocco
The document discusses two cyber threats that existed in Morocco:
1. A password info stealer malware that was responsible for 90% of attacks. Intelligence tracking detected around 180GB of leaked data related to Moroccan domains and personal information, and over 320 spammers were identified from the data with connections to Morocco.
2. An ATM dispense malware that was gathered from Moroccan internet service providers. Technical details about the ATM malware were presented, but not summarized.
The document ends by stating that preparations are being made for the "next war", but does not clarify the purpose of the two threats.
Sharpening your Threat-Hunting Program with ATTACK Framework
From MITRE ATT&CKcon Power Hour December 2020
By Hieu Tran, Threat Detection Team Lead FPT Cybersecurity Division
No matter how sophisticated and thorough your security precautions may be, you cannot assume your security measures are impenetrable. This is why you need a threat hunting program in place. But how can we implement a proper threat hunting program and run it efficiently? In this talk, we will uncover how to sharpen your threat hunting strategy by leveraging ATT&CK. Ultimately, we’ll be demonstrating how effectively employing the hunting methodology in the real-world battlefield, fighting against well-known cyber espionage actors who strongly focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.
Software Composition Analysis Deep Dive
Software composition analysis (SCA) is often sold as an easy win for application security, but ensuring that we have full visibility on the vulnerable components is a lot more challenging that it looks. The remediation costs can also stack up pretty quickly as we try to get rid of deeply nested vulnerable transitive dependencies.
Owasp zap
This document discusses using the OWASP Zed Attack Proxy (ZAP) tool to find vulnerabilities in web applications. ZAP is a free and open-source web application penetration testing tool that can be used to conduct both automated and manual testing of applications. The document provides an overview of ZAP's features, how to install and configure it, how to test applications for vulnerabilities using both automated and direct methods, and how to integrate ZAP with other tools.
Vapt life cycle
1. Vulnerability assessment and penetration testing (VAPT) involves identifying security vulnerabilities in an organization's network and systems through scanning and manual exploitation techniques.
2. The process includes information gathering, scanning to detect vulnerabilities, analysis of vulnerabilities found, and penetration testing to manually exploit vulnerabilities.
3. The final report documents the findings by risk level, technical details of vulnerabilities discovered, and recommendations for remediation.
Malware analysis
- Malware analysis involves both static and dynamic analysis techniques to understand malware behavior and assess potential damage. Static analysis involves disassembling and reviewing malware code and structure without executing it. Dynamic analysis observes malware behavior when executed in an isolated virtual environment.
- Tools for static analysis include file hashing, string extraction, and PE header examination. Dynamic analysis tools monitor the registry, file system, processes, and network traffic created by malware runtime behavior. These include Process Monitor, Wireshark, Process Explorer, and network sniffers.
- To safely conduct malware analysis, one should create an isolated virtual lab separated from production networks, and install behavioral monitoring and code analysis tools like OllyDbg, Process Monitor, and Wiresh
CodeQL a Powerful Binary Analysis Engine
The document discusses extending CodeQL, a static analysis tool, to support binary analysis. It describes adding a new database schema and extractor for binaries, as well as a query language library. A debugger was also developed at the relational algebra level to step through and inspect queries. The approach separates the front-end and back-end of CodeQL to make it modular and adaptable to new languages and analysis tasks.
Mapping ATT&CK Techniques to ENGAGE Activities
From ATT&CKcon 3.0
By David Barroso, CounterCraft
When an adversary engages in a specific behavior, they are vulnerable to expose an unintended weakness. By looking at each ATT&CK technique, we can examine the weaknesses revealed and identify an engagement activity or activities to exploit this weakness.
During the presentation we will see some real examples of how we can use different ATT&CK techniques in order to plan different adversary engagement activities.
Introduction To Vulnerability Assessment & Penetration Testing
A vulnerability assessment identifies vulnerabilities in systems and networks to understand threats and risks. Penetration testing simulates cyber attacks to detect exploitable vulnerabilities. There are three types of penetration testing: black box with no system info; white box with full system info; and grey box with some system info. Common vulnerabilities include SQL injection, XSS, weak authentication, insecure storage, and unvalidated redirects. Tools like Nexpose, QualysGuard, and OpenVAS can automate vulnerability assessments.
Android Security & Penetration Testing
These slides were presented at GDG MeetUp in Bangalore which was held on 21st September 2013. Uploading the slides to help the people who wanted the slide Deck
From Theory to Practice: How My ATTACK Perspectives Have Changed
From MITRE ATT&CKcon Power Hour December 2020
By Katie Nickels, Director of Intelligence, Red Canary
Good analysts (and good human beings) change their minds based on new information. In this presentation, Katie will share how her perspectives on ATT&CK have changed since moving from ATT&CK team member to ATT&CK end-user. She will discuss how her ideas about coverage, procedures, and detection creation have evolved and why those perspectives matter. Katie will also share practical examples from observed threats to help explain the nuances of her perspectives. Attendees should expect to leave this presentation with a better understanding of how to handle challenges they’re likely to face when navigating their own ATT&CK journey.
MITRE ATT&CKcon 2018: ATT&CK as a Teacher, Travis Smith, Tripwire
ATT&CK is valuable for those of us who are heads down in security day in and day out. But what about using ATT&CK to each college interns about security?
This presentation details how Tripwire used ATT&CK to build- out a new training regimen for summer interns. By going through and finding quick wins, Tripwire’s interns were actively engaged in learning about security. The detailed break downs of ATT&CK were greatly beneficial in helping teach security concepts to those who were not yet familiar with them. This session shows the program details and how you might be able to adapt it to your requirements.
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
From MITRE ATT&CKcon Power Hour October 2020
By:
Aunshul Rege, Associate Professor, Temple University, @prof_rege
Rachel Bleiman, PhD Student/NSF Graduate Research Assistant, Temple University, @rab1928
This presentation from the MITRE ATT&CKcon Power Hour session on October 9, 2020, explores the application of the MITRE ATT&CK® and PRE-ATT&CK matrices in cybercrime education and research. Specifically, Rege and Bleiman demonstrate the mapping of the PRE-ATT&CK matrix to social engineering case studies as an experiential learning project in an upper-level cybercrime liberal arts course. It thus allows students to understand the alignment process of threat intelligence to the PRE-ATT&CK framework and also learn about its usefulness/limitations. The talk also discusses the mapping of the ATT&CK matrix, tactics, techniques, software, and groups for two cybercrime datasets created by collating publicly disclosed incidents: (i) critical infrastructure ransomware (CIRW) incidents, and (ii) social engineering (SE) incidents. For the CIRW dataset, 39% of the strains mapped onto the ATT&CK software. For the SE dataset, 49% of the groups and 65% of the techniques map on to the MITRE framework. This helps the researchers identify the framework's usefulness/limitations and also helps our datasets connect to richer information that may not otherwise be available in the publicly disclosed incidents.
Malware Analysis Made Simple
Malware analysis is important for responding quickly to security incidents and keeping costs down. Malware is the number one external threat and is adapting to evade traditional defenses like firewalls and antivirus software. When incidents do occur, organizations should have an in-house capability to analyze malware using free and open-source tools to understand the scope of infections and prevent recurrences.
Penetration testing reporting and methodology
This paper covering information about Penetration testing methodology, standards reporting formats and comparing reports. Explained problem of Cyber Security experts when they making penetration tests. How they doing current presentations.
We will focus our work in penetration testing methodology reporting form and detailed information how to compare result and related work information.
Purple Team Exercise Framework Workshop #PTEF
Purple Team exercises are an efficient and effective method of adversary emulation leading to the training and improvement of people, process, and technology. Red Teams and Blue Teams work together in a live production environment, emulating a selected adversary that has the capability, intent, and opportunity to attack the target organization provided by Cyber Threat Intelligence. Purple Team exercises are ‘hands on keyboard’ exercises where Red and Blue teams work together with an open discussion about each attack procedure and how to detect and alert against it.
Purple Team Exercise Framework #PTEF: https://www.scythe.io/ptef
Ethical Hacking Maturity Model: https://www.scythe.io/library/scythes-ethical-hacking-maturity-model
Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
#ThreatThursday: https://www.scythe.io/threatthursday
#C2Matrix: https://thec2matrix.com/
Atomic Purple Team: https://github.com/DefensiveOrigins/AtomicPurpleTeam
SCYTHE Playbooks: https://github.com/scythe-io/community-threats
#ThreatHunting Playbooks: https://threathunterplaybook.com/introduction.html
VECTR: https://vectr.io/
Unicon: https://www.scythe.io/unicon2020
Breach and attack simulation tools
With the focus on security, most organisations test the security defenses via pen-testing. But what about after the network has been compromised. Is there an Advance Persistent Threat (APT) sitting on the network? Will the defenses be able to detect this?
This talk will discuss some of the open source tools that can help simulate this threat. So as to test the security defenses if an APT makes it onto the network.
Adversary Emulation using CALDERA
Caldera is an automated adversary emulation tool developed by MITRE that links to the MITRE ATT&CK framework. It deploys custom backdoors on target systems to emulate adversary techniques. The tool has a graphical interface to define groups, abilities, adversaries, and operations. Abilities are suites of actions that achieve goals, while adversaries are malicious actors equipped with abilities. Multiple abilities can be grouped in phases, and phases describe the progression of an adversary. Caldera actively attacks targets by deploying backdoors linked to ATT&CK techniques.
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
From ATT&CKcon 3.0
By Jason Wood and Justin Swisher, CrowdStrike
When it comes to understanding and tracking intrusion tradecraft, security teams must have the tools and processes that allow the mapping of hands-on adversary tradecraft. Doing this enables your team to both understand the adversaries and attacks you currently see and observe how these adversaries and attacks evolve over time. This session will explore how a threat hunting team uses MITRE ATT&CK to understand and categorize adversary activity. The team will demonstrate how threat hunters map ATT&CK TTPs by showcasing a recent interactive intrusion against a Linux endpoint and how the framework allowed for granular tracking of tradecraft and enhanced security operations. They will also take a look into the changes in the Linux activity they have observed over time, using the ATT&CK navigator to compare and contrast technique usage. This session will provide insights into how we use MITRE ATT&CK as a powerful resource to track intrusion tradecraft, identify adversary trends, and prepare for attacks of the future.
Containerizing your Security Operations Center
AppSec USA 2016 talk on using containers and Kubernetes to manage a variety of security tools. Includes best practices for securing Kubernetes implementations.
Rise of software supply chain attack
DevConf.us 2021: https://devconfus2021.sched.com/event/lki3/the-rise-of-software-supply-chain-attacks
Code review guidelines
General Code review Guidelines about how to take code reviews,what to look for in code reviews,roles and responsibilities
It's just a jump to the left (of boom): Prioritizing detection implementation...
From ATT&CKcon 3.0
By Lindsay Kaye and Scott Small, Recorded Future
Many organizations ask: "Where do I start, and where do I go next" when prioritizing implementation of behavior-based detections? We often hear "use threat intelligence!" but your goals must be qualified and quantified in order to properly prioritize the most relevant TTPs. A wealth of open-sourced, ATT&CK-mapped resources now exists, giving security teams greater access to both detections and red team tests they can implement, but intelligence (also aligned with ATT&CK), is essential to provide necessary context to ensure that detection efforts are focused effectively.
This session will discuss a new approach to the prioritization challenge, starting with an analysis of the current defensive landscape, as measured by ATT&CK coverage for more than a dozen detection repositories and technologies, and guidance on sourcing TTP intelligence. The team will then show how real-world defensive strategies can be strengthened by encompassing a full-spectrum view of threat detection, including the implementation of YARA, Sigma, and Snort in security appliances. Critically, alignment of both intelligence and defenses with ATT&CK enables defenders to move the focus of detection efforts to indications of malicious behavior before the final payload is deployed, where controls are most effective at preventing serious damage to the organization.
Owasp zap
The document provides information on OWASP ZAP, a free and open source web application security testing tool. It discusses what ZAP is, why it is a good choice for security testing, its key features which include an intercepting proxy, scanners, spiders, and fuzzing. It then describes how to launch and use ZAP, covering its graphical user interface, attacking websites by spidering, scanning and reviewing alerts. Key terms like session and context are also explained. Steps to run a scan are outlined, including crawling the site, creating a session and context, attacking with spider and active scans, and reviewing scan results. Finally, the difference between active and passive scans is summarized.
Hacktivity 2016: Stealthy, hypervisor based malware analysis
This document discusses techniques for stealthy malware analysis using hypervisor-based monitoring. It describes how debuggers can be detected by malware and introduces using a hypervisor like Xen to monitor guest VMs in a more stealthy way. It covers using features like alternate page tables (altp2m) to improve stealth when single-stepping or handling events from multiple VCPUs. Challenges of porting these techniques to ARM and hiding from techniques malware uses to detect debugging and virtualization are also discussed.
Starting Over with Sub-Techniques
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive function. Exercise stimulates the production of endorphins in the brain which elevate mood and reduce stress levels.
Sakha - Corporate Intro
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005. With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & BPM / Workflow solutions. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Sakha - Corporate Intro
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005. With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & BPM / Workflow solutions. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
More Related Content
What's hot
CodeQL a Powerful Binary Analysis Engine
The document discusses extending CodeQL, a static analysis tool, to support binary analysis. It describes adding a new database schema and extractor for binaries, as well as a query language library. A debugger was also developed at the relational algebra level to step through and inspect queries. The approach separates the front-end and back-end of CodeQL to make it modular and adaptable to new languages and analysis tasks.
Mapping ATT&CK Techniques to ENGAGE Activities
From ATT&CKcon 3.0
By David Barroso, CounterCraft
When an adversary engages in a specific behavior, they are vulnerable to expose an unintended weakness. By looking at each ATT&CK technique, we can examine the weaknesses revealed and identify an engagement activity or activities to exploit this weakness.
During the presentation we will see some real examples of how we can use different ATT&CK techniques in order to plan different adversary engagement activities.
Introduction To Vulnerability Assessment & Penetration Testing
A vulnerability assessment identifies vulnerabilities in systems and networks to understand threats and risks. Penetration testing simulates cyber attacks to detect exploitable vulnerabilities. There are three types of penetration testing: black box with no system info; white box with full system info; and grey box with some system info. Common vulnerabilities include SQL injection, XSS, weak authentication, insecure storage, and unvalidated redirects. Tools like Nexpose, QualysGuard, and OpenVAS can automate vulnerability assessments.
Android Security & Penetration Testing
These slides were presented at GDG MeetUp in Bangalore which was held on 21st September 2013. Uploading the slides to help the people who wanted the slide Deck
From Theory to Practice: How My ATTACK Perspectives Have Changed
From MITRE ATT&CKcon Power Hour December 2020
By Katie Nickels, Director of Intelligence, Red Canary
Good analysts (and good human beings) change their minds based on new information. In this presentation, Katie will share how her perspectives on ATT&CK have changed since moving from ATT&CK team member to ATT&CK end-user. She will discuss how her ideas about coverage, procedures, and detection creation have evolved and why those perspectives matter. Katie will also share practical examples from observed threats to help explain the nuances of her perspectives. Attendees should expect to leave this presentation with a better understanding of how to handle challenges they’re likely to face when navigating their own ATT&CK journey.
MITRE ATT&CKcon 2018: ATT&CK as a Teacher, Travis Smith, Tripwire
ATT&CK is valuable for those of us who are heads down in security day in and day out. But what about using ATT&CK to each college interns about security?
This presentation details how Tripwire used ATT&CK to build- out a new training regimen for summer interns. By going through and finding quick wins, Tripwire’s interns were actively engaged in learning about security. The detailed break downs of ATT&CK were greatly beneficial in helping teach security concepts to those who were not yet familiar with them. This session shows the program details and how you might be able to adapt it to your requirements.
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
From MITRE ATT&CKcon Power Hour October 2020
By:
Aunshul Rege, Associate Professor, Temple University, @prof_rege
Rachel Bleiman, PhD Student/NSF Graduate Research Assistant, Temple University, @rab1928
This presentation from the MITRE ATT&CKcon Power Hour session on October 9, 2020, explores the application of the MITRE ATT&CK® and PRE-ATT&CK matrices in cybercrime education and research. Specifically, Rege and Bleiman demonstrate the mapping of the PRE-ATT&CK matrix to social engineering case studies as an experiential learning project in an upper-level cybercrime liberal arts course. It thus allows students to understand the alignment process of threat intelligence to the PRE-ATT&CK framework and also learn about its usefulness/limitations. The talk also discusses the mapping of the ATT&CK matrix, tactics, techniques, software, and groups for two cybercrime datasets created by collating publicly disclosed incidents: (i) critical infrastructure ransomware (CIRW) incidents, and (ii) social engineering (SE) incidents. For the CIRW dataset, 39% of the strains mapped onto the ATT&CK software. For the SE dataset, 49% of the groups and 65% of the techniques map on to the MITRE framework. This helps the researchers identify the framework's usefulness/limitations and also helps our datasets connect to richer information that may not otherwise be available in the publicly disclosed incidents.
Malware Analysis Made Simple
Malware analysis is important for responding quickly to security incidents and keeping costs down. Malware is the number one external threat and is adapting to evade traditional defenses like firewalls and antivirus software. When incidents do occur, organizations should have an in-house capability to analyze malware using free and open-source tools to understand the scope of infections and prevent recurrences.
Penetration testing reporting and methodology
This paper covering information about Penetration testing methodology, standards reporting formats and comparing reports. Explained problem of Cyber Security experts when they making penetration tests. How they doing current presentations.
We will focus our work in penetration testing methodology reporting form and detailed information how to compare result and related work information.
Purple Team Exercise Framework Workshop #PTEF
Purple Team exercises are an efficient and effective method of adversary emulation leading to the training and improvement of people, process, and technology. Red Teams and Blue Teams work together in a live production environment, emulating a selected adversary that has the capability, intent, and opportunity to attack the target organization provided by Cyber Threat Intelligence. Purple Team exercises are ‘hands on keyboard’ exercises where Red and Blue teams work together with an open discussion about each attack procedure and how to detect and alert against it.
Purple Team Exercise Framework #PTEF: https://www.scythe.io/ptef
Ethical Hacking Maturity Model: https://www.scythe.io/library/scythes-ethical-hacking-maturity-model
Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
#ThreatThursday: https://www.scythe.io/threatthursday
#C2Matrix: https://thec2matrix.com/
Atomic Purple Team: https://github.com/DefensiveOrigins/AtomicPurpleTeam
SCYTHE Playbooks: https://github.com/scythe-io/community-threats
#ThreatHunting Playbooks: https://threathunterplaybook.com/introduction.html
VECTR: https://vectr.io/
Unicon: https://www.scythe.io/unicon2020
Breach and attack simulation tools
With the focus on security, most organisations test the security defenses via pen-testing. But what about after the network has been compromised. Is there an Advance Persistent Threat (APT) sitting on the network? Will the defenses be able to detect this?
This talk will discuss some of the open source tools that can help simulate this threat. So as to test the security defenses if an APT makes it onto the network.
Adversary Emulation using CALDERA
Caldera is an automated adversary emulation tool developed by MITRE that links to the MITRE ATT&CK framework. It deploys custom backdoors on target systems to emulate adversary techniques. The tool has a graphical interface to define groups, abilities, adversaries, and operations. Abilities are suites of actions that achieve goals, while adversaries are malicious actors equipped with abilities. Multiple abilities can be grouped in phases, and phases describe the progression of an adversary. Caldera actively attacks targets by deploying backdoors linked to ATT&CK techniques.
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
From ATT&CKcon 3.0
By Jason Wood and Justin Swisher, CrowdStrike
When it comes to understanding and tracking intrusion tradecraft, security teams must have the tools and processes that allow the mapping of hands-on adversary tradecraft. Doing this enables your team to both understand the adversaries and attacks you currently see and observe how these adversaries and attacks evolve over time. This session will explore how a threat hunting team uses MITRE ATT&CK to understand and categorize adversary activity. The team will demonstrate how threat hunters map ATT&CK TTPs by showcasing a recent interactive intrusion against a Linux endpoint and how the framework allowed for granular tracking of tradecraft and enhanced security operations. They will also take a look into the changes in the Linux activity they have observed over time, using the ATT&CK navigator to compare and contrast technique usage. This session will provide insights into how we use MITRE ATT&CK as a powerful resource to track intrusion tradecraft, identify adversary trends, and prepare for attacks of the future.
Containerizing your Security Operations Center
AppSec USA 2016 talk on using containers and Kubernetes to manage a variety of security tools. Includes best practices for securing Kubernetes implementations.
Rise of software supply chain attack
DevConf.us 2021: https://devconfus2021.sched.com/event/lki3/the-rise-of-software-supply-chain-attacks
Code review guidelines
General Code review Guidelines about how to take code reviews,what to look for in code reviews,roles and responsibilities
It's just a jump to the left (of boom): Prioritizing detection implementation...
From ATT&CKcon 3.0
By Lindsay Kaye and Scott Small, Recorded Future
Many organizations ask: "Where do I start, and where do I go next" when prioritizing implementation of behavior-based detections? We often hear "use threat intelligence!" but your goals must be qualified and quantified in order to properly prioritize the most relevant TTPs. A wealth of open-sourced, ATT&CK-mapped resources now exists, giving security teams greater access to both detections and red team tests they can implement, but intelligence (also aligned with ATT&CK), is essential to provide necessary context to ensure that detection efforts are focused effectively.
This session will discuss a new approach to the prioritization challenge, starting with an analysis of the current defensive landscape, as measured by ATT&CK coverage for more than a dozen detection repositories and technologies, and guidance on sourcing TTP intelligence. The team will then show how real-world defensive strategies can be strengthened by encompassing a full-spectrum view of threat detection, including the implementation of YARA, Sigma, and Snort in security appliances. Critically, alignment of both intelligence and defenses with ATT&CK enables defenders to move the focus of detection efforts to indications of malicious behavior before the final payload is deployed, where controls are most effective at preventing serious damage to the organization.
Owasp zap
The document provides information on OWASP ZAP, a free and open source web application security testing tool. It discusses what ZAP is, why it is a good choice for security testing, its key features which include an intercepting proxy, scanners, spiders, and fuzzing. It then describes how to launch and use ZAP, covering its graphical user interface, attacking websites by spidering, scanning and reviewing alerts. Key terms like session and context are also explained. Steps to run a scan are outlined, including crawling the site, creating a session and context, attacking with spider and active scans, and reviewing scan results. Finally, the difference between active and passive scans is summarized.
Hacktivity 2016: Stealthy, hypervisor based malware analysis
This document discusses techniques for stealthy malware analysis using hypervisor-based monitoring. It describes how debuggers can be detected by malware and introduces using a hypervisor like Xen to monitor guest VMs in a more stealthy way. It covers using features like alternate page tables (altp2m) to improve stealth when single-stepping or handling events from multiple VCPUs. Challenges of porting these techniques to ARM and hiding from techniques malware uses to detect debugging and virtualization are also discussed.
Starting Over with Sub-Techniques
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive function. Exercise stimulates the production of endorphins in the brain which elevate mood and reduce stress levels.
What's hot (20)
Introduction To Vulnerability Assessment & Penetration Testing
Introduction To Vulnerability Assessment & Penetration Testing
From Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have Changed
MITRE ATT&CKcon 2018: ATT&CK as a Teacher, Travis Smith, Tripwire
MITRE ATT&CKcon 2018: ATT&CK as a Teacher, Travis Smith, Tripwire
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
It's just a jump to the left (of boom): Prioritizing detection implementation...
It's just a jump to the left (of boom): Prioritizing detection implementation...
Hacktivity 2016: Stealthy, hypervisor based malware analysis
Hacktivity 2016: Stealthy, hypervisor based malware analysis
More from Sakha Global
Sakha - Corporate Intro
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005. With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & BPM / Workflow solutions. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Sakha - Corporate Intro
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005. With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & BPM / Workflow solutions. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Sakha - Corporate Profile
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005.
With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & BPM / Workflow solutions. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Sakha - Corporate Profile
Sakha has been transforming ideas into solutions through technology consulting & software development since 2005.
With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & Pega BPM. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Web3 - The Decentralized Internet of the Future
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise boosts blood flow, releases endorphins, and promotes changes in the brain which help enhance one's emotional well-being and mental clarity.
Deep Recommendations for e-Commerce
Nowadays, product recommendation engines can understand customers in real time and suggest the best matching using several different machine learning algorithms.
Unfortunately, many e-commerce stores put basic category levels or best-selling product recommendations on their websites, and never revise them or customize them again. They stand to gain by implementing recommendation engines.
Deep learning works similarly to machine learning models, but deep learning uses more than one million data points and can determine whether the prediction is correct. Since deep learning is a self-learning system, manual intervention is no longer required, so the results can be used immediately.
The core idea of deep learning-based recommendations is to unite all side-information features into subnetworks of user-related and item-related features and learn the similarity between their latent representations using neural matrix factorization.
It has been demonstrated that deep learning with heterogeneous input significantly increases overall recommendation quality which makes it suitable for recommendations with rich side information about items and users.
This SlideShare explores the concept of using deep recommendations for e-commerce in brief.
Application for Blockchain in Crowdsourcing Data
Crowdsourcing provides a distributed problem-solving paradigm which is not the same as traditional outsourcing computation. These systems are generally centralized platforms which match the requesters’ and workers’ task pair with fair exchange of rewards.
Blockchain technology has attracted considerable attention due to the boom of cryptocurrencies and decentralized applications. Among them, the emerging blockchain-based crowdsourcing is a typical paradigm, which gets rid of centralized cloud-servers and leverages smart contracts to realize task recommendation and reward distribution. Blockchain-based crowdsourcing systems can mitigate some known limitations of the centralized crowdsourcing platform, such as single point of failure and Sybil attacks.
This SlideShare explores the concept of Blockchain in crowdsourcing data in brief.
Sakha - Corporate Profile
Sakha Global has been transforming ideas into solutions through technology consulting & software development since 2005.
With presence in USA & India and a team of 400+ resources, we are a recognized solution specialist in product development with 150+ products delivered worldwide in the areas of Mobile (Android & iOS), Big Data, Machine Learning, Blockchain, AR / VR, IoT & Pega BPM. We have offices across USA, with a development center in Bangalore, India. We are ISO 9001:2015 certified.
Migration of Containerized Legacy Application to the Cloud
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise causes chemical changes in the brain that may help boost feelings of calmness, happiness and focus.
Infrastructure as Code
Infrastructure as Code, also referred to as IaC, is an IT practice that codifies and manages underlying IT infrastructure as software. The purpose of Infrastructure as Code is to enable developers or operations teams to automatically manage, monitor and provision resources, rather than manually configure discrete hardware devices and operating systems. Infrastructure as Code is sometimes referred to as programmable or software-defined infrastructure.
The concept of Infrastructure as Code is similar to programming scripts, which are used to automate IT processes. However, scripts are primarily used to automate a series of static steps that are repeated numerous times across multiple servers. Infrastructure as Code uses higher-level or descriptive language to code more versatile and adaptive provisioning and deployment processes.
This SlideShare explores the concept of Infrastructure as Code in brief.
OpenTelemetry - The Open Source Vision for Unified Observability
OpenTelemetry is a collection of tools, APIs and SDKs, used to instrument, generate, collect, and export telemetry data (metrics, logs and traces) to help analyze a software’s performance and behavior.
OpenTelemetry (also referred to as OTel) aims to address the full range of observability signals across traces, metrics and logs. Loosely defined, observability is the ability to understand what’s happening inside a system from the knowledge of the external data it produces, which are usually logs, metrics, and traces.
Having a common format for how observability data is collected and sent is where OpenTelemetry comes into play. As a Cloud Native Computing Foundation (CNCF) incubating project, OTel aims to provide unified sets of vendor-agnostic libraries and APIs — mainly for collecting data and transferring it somewhere.
This SlideShare explores OpenTelemetry in brief.
Automating Software Delivery on Multiple Clouds
It can be difficult for enterprise application development or IT operations professionals to get their arms around multi-cloud DevOps.
That's because a single multi-cloud deployment might depend on hundreds of remote application and infrastructure components. These, in turn, might use myriad interfaces and orchestrations, and execute in dozens of clouds with varying degrees of federated interoperability.
Multi-clouds have already arrived in enterprises. According to a recent survey , around 85% of companies are already operating multiple clouds. However, only 39% of respondents have implemented DevOps processes and tool chains across these deployments.
To ensure the CI/CD of applications and infrastructure across increasingly heterogeneous clouds, enterprises will need DevOps tools that integrate with those platforms. This SlideShare explores the concept of Automating Software Delivery on Multiple Clouds in brief.
Ways to Improve Code Quality
Code quality is important, as it impacts the overall software quality. And quality impacts how safe, secure, and reliable a codebase is. High quality is critical for many development teams today. And it's especially important for those developing safety-critical systems.
Just one line of poorly written code can drive an enterprise into the ground, meaning that development projects can also come to an end because of them. That’s why improving code quality is necessary. This SlideShare explores ways to improve code quality in brief.
How the SVG Format is Reducing Carbon Footprint
The internet has a carbon footprint. Behind the rhetoric of digital solutions making our lives lighter, there is a very big problem. The internet, and our usage of it, is not so light at all. The internet as a whole currently accounts for 2% of global emissions. That’s the same as all global aviation. And this figure is increasing rapidly. The more data we consume, the more energy we use, and data consumption shows no signs of slowing as people worldwide grasp for better and faster internet speeds. By 2025, Cisco predicts that the internet will account for 3.5% of global carbon emissions.
The internet is not slowing down. As it matures and plays more of an integral part in our lives, we expect more from the internet. As each year passes, people are developing more complex, visually elaborate websites. These websites may look and work well – but behind the scenes they are bloated, using huge amounts of energy each time they are loaded. To put this in perspective: loading the average website uses up the equivalent amount of energy as boiling a kettle for a cup of tea. Environmental guilt has started to creep into everyday life for most people. There is always a sense that we should be doing better.
Thankfully, there are many things we can do to reduce our internet carbon footprint. One of the means is using the most efficient file format for graphics (such as SVG) to lessen the power needed to load the site. This SlideShare explores the concept of SVG format in brief.
5G-based Product Development
Millennials have seen multiple breakthroughs in wireless technology. GSM networks brought us the cell phone age in the 90s. 3G networks gave us the smartphone age a decade later. 4G and LTE brought us our paradoxical world of complaining if things take more than a few seconds to load.
4G networks are still being built, 3G phones are still being sold, but there’s a new technology on the horizon. A new and improved technology, 5G (5th generation) mobile networks will bring many changes. The next generation of wireless connectivity, 5G, is becoming a ubiquitous topic but is still the subject of many myths and misconceptions. Although various use cases are emerging, only a few are compelling enough to generate strong demand in the short term. This SlideShare explores the concept of 5G-based product development in brief.
Improving User Engagement through Gamification
Engaged consumers have a significant impact on the bottom line. Brands that successfully engage their customers realize lower customer attrition and higher share of wallet. Gamification is a recent mechanism to increase customer engagement, born our of the user-centered approach.
The user-centered approach, which strives for creating products highly responding to the user’s needs, has become the major philosophy behind many projects. Following this method, designers constantly search for the new techniques improving user experience which depends on various aspects including emotions. The thing is that users expect a product to be simple and enjoyable in use, so the idea to add a “fun” element to the UX came as it is. But how to make the product fun and enjoyable in use? The technique called gamification was created to solve the problem. This SlideShare explores what’s the method of gamification in design and how it can improve UX and engagement.
Next Generation Rendering with Angular Ivy
Ivy is Angular's new rendering pipeline and view engine. Smaller bundles, faster compilations, better debugging, dynamic loading of module & components, and advanced concepts like higher order components are promised by this 8.0 version of Angular.
Angular already being a popular platform for building mobile and desktop web applications, the current version 8.0 aka Ivy has backward compatibility and by using it we can get smaller bundles, easier to debug API, faster compilation and dynamic loading of modules and components. This SlideShare explores the concept of Angular Ivy in brief.
The Power of CSS Houdini
The document discusses the benefits of exercise for mental health. Regular physical activity can help reduce anxiety and depression and improve mood and cognitive functioning. Exercise boosts blood flow and levels of neurotransmitters and endorphins which elevate and stabilize mood.
Decentralizing the Internet of Things (IoT)
The success of the Internet of Things (IoT) depends heavily on the extent of achieved interoperability, as well as on addressing the many security and privacy challenges. Due to the multitude of types of devices, systems, and protocols, and their scale of deployment and limited resources, some of these systems will be extremely challenging to interconnect and secure. The underlying edge network or edge-computing infrastructure, supporting the IoT, will also need to provide security and privacy guarantees.
Given that IoT devices and edge networks are deployed by a multitude of players, decentralization has become a key enabling design goal of the system. For example, recent advances in Distributed Ledger Technology (DLT) and Blockchains can be incorporated to support decentralized security. In turn, decentralized security through distributed trust can help overcome privacy concerns and scalability bottlenecks, both of which are becoming increasingly serious in large-scale deployments, such as smart cities or Industry 4.0.
A decentralized approach to IoT interconnection brings forth many opportunities, but also important challenges, e.g., in state synchronization, trust management, and the difficulties of operating with constrained devices and networking modes.
This SlideShare explores the concept of Decentralized Computing in IoT in brief.
Digital Advertising with Facebook Pixel
What matters most to the vast majority of digital marketers is the ability to see direct results and tie advertising costs back to those efforts. Facebook Pixel is a tool within Facebook for Business. It can track conversions (actions) on a website as a result of Facebook Ads, retarget specific audiences, and give valuable insight into how users are interacting with content. These are huge, exceptionally valuable benefits.
Out of all of the incredible tools Facebook has created for marketers, perhaps the most useful is Facebook Pixel. This SlideShare explores the concept of Facebook Pixel in brief.
More from Sakha Global (20)
Migration of Containerized Legacy Application to the Cloud
Migration of Containerized Legacy Application to the Cloud
OpenTelemetry - The Open Source Vision for Unified Observability
OpenTelemetry - The Open Source Vision for Unified Observability
Recently uploaded
Flutter vs. React Native: A Detailed Comparison for App Development in 2024
Choosing the right framework for your cross-platform mobile app can be a tough decision. Both Flutter and React Native offer compelling features and have earned their place in the development world. Here is a detailed comparison to help you weigh their strengths and weaknesses. Here are the pros and cons of developing mobile apps in React Native vs Flutter.
Assure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyes
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0
A Comprehensive Guide on Implementing Real-World Mobile Testing Strategies fo...
In today's fiercely competitive mobile app market, the role of the QA team is pivotal for continuous improvement and sustained success. Effective testing strategies are essential to navigate the challenges confidently and precisely. Ensuring the perfection of mobile apps before they reach end-users requires thoughtful decisions in the testing plan.
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
IBM watsonx Code Assistant for Z, our latest Generative AI-assisted mainframe application modernization solution. Mainframe (IBM Z) application modernization is a topic that every mainframe client is addressing to various degrees today, driven largely from digital transformation. With generative AI comes the opportunity to reimagine the mainframe application modernization experience. Infusing generative AI will enable speed and trust, help de-risk, and lower total costs associated with heavy-lifting application modernization initiatives. This document provides an overview of the IBM watsonx Code Assistant for Z which uses the power of generative AI to make it easier for developers to selectively modernize COBOL business services while maintaining mainframe qualities of service.
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Consistent toolbox talks are critical for maintaining workplace safety, as they provide regular opportunities to address specific hazards and reinforce safe practices.
These brief, focused sessions ensure that safety is a continual conversation rather than a one-time event, which helps keep safety protocols fresh in employees' minds. Studies have shown that shorter, more frequent training sessions are more effective for retention and behavior change compared to longer, infrequent sessions.
Engaging workers regularly, toolbox talks promote a culture of safety, empower employees to voice concerns, and ultimately reduce the likelihood of accidents and injuries on site.
The traditional method of conducting safety talks with paper documents and lengthy meetings is not only time-consuming but also less effective. Manual tracking of attendance and compliance is prone to errors and inconsistencies, leading to gaps in safety communication and potential non-compliance with OSHA regulations. Switching to a digital solution like Safelyio offers significant advantages.
Safelyio automates the delivery and documentation of safety talks, ensuring consistency and accessibility. The microlearning approach breaks down complex safety protocols into manageable, bite-sized pieces, making it easier for employees to absorb and retain information.
This method minimizes disruptions to work schedules, eliminates the hassle of paperwork, and ensures that all safety communications are tracked and recorded accurately. Ultimately, using a digital platform like Safelyio enhances engagement, compliance, and overall safety performance on site. https://safelyio.com/
ppt on the brain chip neuralink.pptx
A neural network is a machine learning program, or model, that makes decisions in a manner similar to the human brain, by using processes that mimic the way biological neurons work together to identify phenomena, weigh options and arrive at conclusions.
Boost Your Savings with These Money Management Apps
A money management app can transform your financial life by tracking expenses, creating budgets, and setting financial goals. These apps offer features like real-time expense tracking, bill reminders, and personalized insights to help you save and manage money effectively. With a user-friendly interface, they simplify financial planning, making it easier to stay on top of your finances and achieve long-term financial stability.
Building API data products on top of your real-time data infrastructure
This talk and live demonstration will examine how Confluent and Gravitee.io integrate to unlock value from streaming data through API products.
You will learn how data owners and API providers can document, secure data products on top of Confluent brokers, including schema validation, topic routing and message filtering.
You will also see how data and API consumers can discover and subscribe to products in a developer portal, as well as how they can integrate with Confluent topics through protocols like REST, Websockets, Server-sent Events and Webhooks.
Whether you want to monetize your real-time data, enable new integrations with partners, or provide self-service access to topics through various protocols, this webinar is for you!
The Power of Visual Regression Testing_ Why It Is Critical for Enterprise App...
Visual testing plays a vital role in ensuring that software products meet the aesthetic requirements specified by clients in functional and non-functional specifications. In today's highly competitive digital landscape, users expect a seamless and visually appealing online experience. Visual testing, also known as automated UI testing or visual regression testing, verifies the accuracy of the visual elements that users interact with.
J-Spring 2024 - Going serverless with Quarkus, GraalVM native images and AWS ...
Presented at NLJUG's J-Spring 2024.
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM 🐰
How GenAI Can Improve Supplier Performance Management.pdf
Data Collection and Analysis with GenAI enables organizations to gather, analyze, and visualize vast amounts of supplier data, identifying key performance indicators and trends. Predictive analytics forecast future supplier performance, mitigating risks and seizing opportunities. Supplier segmentation allows for tailored management strategies, optimizing resource allocation. Automated scorecards and reporting provide real-time insights, enhancing transparency and tracking progress. Collaboration is fostered through GenAI-powered platforms, driving continuous improvement. NLP analyzes unstructured feedback, uncovering deeper insights into supplier relationships. Simulation and scenario planning tools anticipate supply chain disruptions, supporting informed decision-making. Integration with existing systems enhances data accuracy and consistency. McKinsey estimates GenAI could deliver $2.6 trillion to $4.4 trillion in economic benefits annually across industries, revolutionizing procurement processes and delivering significant ROI.
Streamlining End-to-End Testing Automation
Streamlining End-to-End Testing Automation with Azure DevOps Build & Release Pipelines
Automating end-to-end (e2e) test for Android and iOS native apps, and web apps, within Azure build and release pipelines, poses several challenges. This session dives into the key challenges and the repeatable solutions implemented across multiple teams at a leading Indian telecom disruptor, renowned for its affordable 4G/5G services, digital platforms, and broadband connectivity.
Challenge #1. Ensuring Test Environment Consistency: Establishing a standardized test execution environment across hundreds of Azure DevOps agents is crucial for achieving dependable testing results. This uniformity must seamlessly span from Build pipelines to various stages of the Release pipeline.
Challenge #2. Coordinated Test Execution Across Environments: Executing distinct subsets of tests using the same automation framework across diverse environments, such as the build pipeline and specific stages of the Release Pipeline, demands flexible and cohesive approaches.
Challenge #3. Testing on Linux-based Azure DevOps Agents: Conducting tests, particularly for web and native apps, on Azure DevOps Linux agents lacking browser or device connectivity presents specific challenges in attaining thorough testing coverage.
This session delves into how these challenges were addressed through:
1. Automate the setup of essential dependencies to ensure a consistent testing environment.
2. Create standardized templates for executing API tests, API workflow tests, and end-to-end tests in the Build pipeline, streamlining the testing process.
3. Implement task groups in Release pipeline stages to facilitate the execution of tests, ensuring consistency and efficiency across deployment phases.
4. Deploy browsers within Docker containers for web application testing, enhancing portability and scalability of testing environments.
5. Leverage diverse device farms dedicated to Android, iOS, and browser testing to cover a wide range of platforms and devices.
6. Integrate AI technology, such as Applitools Visual AI and Ultrafast Grid, to automate test execution and validation, improving accuracy and efficiency.
7. Utilize AI/ML-powered central test automation reporting server through platforms like reportportal.io, providing consolidated and real-time insights into test performance and issues.
These solutions not only facilitate comprehensive testing across platforms but also promote the principles of shift-left testing, enabling early feedback, implementing quality gates, and ensuring repeatability. By adopting these techniques, teams can effectively automate and execute tests, accelerating software delivery while upholding high-quality standards across Android, iOS, and web applications.
42 Ways to Generate Real Estate Leads - Sellxpert
Generate hot real estate leads with these simple strategies. 42 innovative ways to attract clients in the real estate industry.
What is Continuous Testing in DevOps - A Definitive Guide.pdf
Once an overlooked aspect, continuous testing has become indispensable for enterprises striving to accelerate application delivery and reduce business impacts. According to a Statista report, 31.3% of global enterprises have embraced continuous integration and deployment within their DevOps, signaling a pervasive trend toward hastening release cycles.
Recently uploaded (20)
Flutter vs. React Native: A Detailed Comparison for App Development in 2024
Flutter vs. React Native: A Detailed Comparison for App Development in 2024
Assure Contact Center Experiences for Your Customers With ThousandEyes
Assure Contact Center Experiences for Your Customers With ThousandEyes
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
Operational ease MuleSoft and Salesforce Service Cloud Solution v1.0.pptx
A Comprehensive Guide on Implementing Real-World Mobile Testing Strategies fo...
A Comprehensive Guide on Implementing Real-World Mobile Testing Strategies fo...
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
Baha Majid WCA4Z IBM Z Customer Council Boston June 2024.pdf
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Safelyio Toolbox Talk Softwate & App (How To Digitize Safety Meetings)
Boost Your Savings with These Money Management Apps
Boost Your Savings with These Money Management Apps
Computer Science & Engineering VI Sem- New Syllabus.pdf
Computer Science & Engineering VI Sem- New Syllabus.pdf
Building API data products on top of your real-time data infrastructure
Building API data products on top of your real-time data infrastructure
The Power of Visual Regression Testing_ Why It Is Critical for Enterprise App...
The Power of Visual Regression Testing_ Why It Is Critical for Enterprise App...
J-Spring 2024 - Going serverless with Quarkus, GraalVM native images and AWS ...
J-Spring 2024 - Going serverless with Quarkus, GraalVM native images and AWS ...
All you need to know about Spring Boot and GraalVM
All you need to know about Spring Boot and GraalVM
Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx
Migration From CH 1.0 to CH 2.0 and Mule 4.6 & Java 17 Upgrade.pptx
How GenAI Can Improve Supplier Performance Management.pdf
How GenAI Can Improve Supplier Performance Management.pdf
What is Continuous Testing in DevOps - A Definitive Guide.pdf
What is Continuous Testing in DevOps - A Definitive Guide.pdf