Automating Dynamic Application Security Testing at Scale

The BlueHat Podcast

Content provided by Bruce Bracken. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Bruce Bracken or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.

3M ago 45:56

MP3•Episode home

In this episode of The BlueHat Podcast, hosts Nic Fillingham and Wendy Zenone are joined by Jason Geffner, Principal Security Architect at Microsoft, to discuss his groundbreaking work on scaling and automating Dynamic Application Security Testing (DAST). Following on from his BlueHat 2024 session, and outlined in this MSRC blog post, Jason explains the key differences between DAST, SAST, and IAST, and dives into the challenges of scaling DAST at Microsoft’s enterprise level, detailing how automation eliminates manual configuration and improves efficiency for web service testing.

In This Episode You Will Learn:

Overcoming the challenges of authenticated requests for DAST tools
The importance of API specs for DAST and how automation streamlines the process
Insights into how Microsoft uses DAST to protect its vast array of web services

Some Questions We Ask:

What's a lesson from this work that you can share with those without Microsoft's resources?
Can you explain what the transparent auth protocol is that you mentioned in the blog post?
How is your work reducing the manual effort needed to configure DAST system services?

Resources:

View Jason Geffner on LinkedIn

View Wendy Zenone on LinkedIn

View Nic Fillingham on LinkedIn

Related BlueHat Session Recording: BlueHat 2024: S10: How Microsoft is Scaling DAST

Related Microsoft Podcasts:

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

54 episodes

#Tech #Bruce Bracken #Cybersecurity #Security Research #Hacking #Red Team #Blue Teaming #Incident Response #Vulnerability Research #Threat Intel #Security Ai #Penetration Testing #InfoSec #Information Security #Hackers #Artificial Intelligence #Machine Learning