The Final Frontier, Automating DYNAMIC Security Testing

The talk takes on dynamic application security testing (DAST), which the speakers describe as the hardest part of security automation to get right. They start by contrasting static and dynamic testing, then lay out the obstacles that tend to appear: staging environments that drift from production, different inline controls such as WAFs, mismatched data, and the difficulty of provisioning test accounts for authenticated scans.

The middle section covers the decisions that shape a scan. Unauthenticated scans are simpler and easier to get approved, while authenticated scans reach much more of the application but need careful credential and login handling. Full crawls are thorough but slow, and targeted crawls focus on the riskiest areas. The speakers frame adoption as a maturity path, moving from a proof of concept to tuning a scanner and then to scheduled, hands-off runs. They also discuss static versus ephemeral environments, configuration management, containers, and tailoring reports for developers versus auditors.

The closing part is a live demo in which a Docker Compose setup launches an SSL checker and OWASP ZAP against a deliberately vulnerable web application. Results are written to a shared volume and imported into DefectDojo. Practical takeaways include starting with a narrow scope, using open-source tools to prove value before buying, checking whether a commercial scanner's API really supports automation, and keeping scan duration in line with commit frequency. Findings should also flow into the tools developers already use rather than arriving as large PDFs.