CISO Tradecraft®

#113 - SAST Security (with John Steven)

Listen Later

This episode provides a deep dive into Static Application Security Testing (SAST) tools.  Learn how they work, why they don't work as well as you think they will in certain use cases, and find some novel ways apply them to your organization.  Special thanks to John Steven for coming on the show to share his expertise.  

 

Special thanks to our sponsor Praetorian for supporting this episode.

https://www.praetorian.com/

Full Transcripts - https://docs.google.com/document/d/1zoA70k78IjqyJky-2u7_-i2jlWke8_cb

Chapters:

  • 00:00 Introduction
  • 02:51 Source Code Analyzers
  • 04:22 The three bears of Static Analysis
  • 06:01 Do Linters work Better?
  • 08:00 The Value of Full Programming Analysis Tools over Linters
  • 11:30 The Impact of a Developer's Analysis on a Developer Environment
  • 13:05 SAST Testing
  • 15:47 OWASP Benchmarking
  • 19:13 The First Static Analysis Tools
  • 20:53 Can you break up that worry about Automated Testing?
  • 22:44 Using Static Analysis for Defect Discovery
  • 24:18 Using Static Analysis to Improve Web Security
  • 31:37 Using Static Analysis to Drive Cloud Security
  • 33:15 The Second Thing to Look Out for When Choosing a Static Analysis Tool
  • 34:55 Using Static Analysis to Build a Vulnerability Management Practice
  • 37:35 Can you use Static Analysis to Find Insider Threat?
    • ...more
    View all episodesView all episodes
    Download on the App Store
    CISO Tradecraft®By CISO Tradecraft®
    • 4.8
    • 4.8
    • 4.8
    • 4.8
    • 4.8

    4.8

    48 ratings

    More shows like CISO Tradecraft®

    View all
    Risky Business by Patrick Gray

    Risky Business

    363 Listeners

    SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) by Johannes B. Ullrich

    SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast)

    633 Listeners

    Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec by Jerry Bell and Andrew Kalat

    Defensive Security Podcast - Malware, Hacking, Cyber Security & Infosec

    371 Listeners

    Hacked by Hacked

    Hacked

    175 Listeners

    CyberWire Daily by N2K Networks

    CyberWire Daily

    1,009 Listeners

    Smashing Security by Graham Cluley & Carole Theriault

    Smashing Security

    313 Listeners

    Click Here by Recorded Future News

    Click Here

    385 Listeners

    Malicious Life by Malicious Life

    Malicious Life

    926 Listeners

    Darknet Diaries by Jack Rhysider

    Darknet Diaries

    7,830 Listeners

    Cybersecurity Today by Jim Love

    Cybersecurity Today

    141 Listeners

    CISO Series Podcast by David Spark, Mike Johnson, and Andy Ellis

    CISO Series Podcast

    187 Listeners

    Hacking Humans by N2K Networks

    Hacking Humans

    308 Listeners

    Defense in Depth by David Spark, Steve Zalewski, Geoff Belknap

    Defense in Depth

    72 Listeners

    Cyber Security Headlines by CISO Series

    Cyber Security Headlines

    120 Listeners

    Risky Bulletin by risky.biz

    Risky Bulletin

    33 Listeners