OWASP DefectDojo

Author: OWASP Foundation - Bewertung: 1x - Views:4

Agenda for the OWASP DefectDojo project showcase:



I. Introduction to OWASP DefectDojo



A. What is DefectDojo?

1. Open-source vulnerability management tool

2. Designed to streamline security testing and vulnerability tracking



B. Why is it important?

1. Improves application security posture

2. Accelerates remediation efforts

3. Provides clearer understanding of overall security landscape



II. Key Features of DefectDojo



A. Aggregation of Security Findings

1. Supports various scanning tools (SAST, DAST, SCA, etc.)

2. Centralized repository for vulnerabilities



B. Collaboration Facilitation

1. Bridges development and security teams

2. Workflow management for remediation



C. Comprehensive Reporting

1. Risk assessment

2. Compliance reporting

3. Customizable dashboards



III. Benefits and Use Cases



A. Enhanced Vulnerability Management

1. Prioritization of critical vulnerabilities

2. Tracking of remediation progress



B. Improved Security Posture

1. Proactive identification of security flaws

2. Reduced attack surface



C. Real-world applications

1. Integrating into CI/CD pipelines

2. Managing bug bounty programs



IV. Live Demonstration (Optional, but Recommended)



A. Basic workflow: importing findings, creating engagements, tracking vulnerabilities

B. Example of a comprehensive report



V. Conclusion



A. Recap of DefectDojo's value proposition

B. Q&A session

C. Resources for further learning



Matt Tesauro

Defect Dojo

Distinguished Engineer, Founder and AppSec guru

Texas

https://defectdojo.com/blog



Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity and training emerging and senior professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement in open-source projects, presentations, trainings and new technology innovation. _x000D_

_x000D_

As a versatile engineer, Matt’s background spans software development (primarily web development), Linux system administration, penetration testing and application / cloud security. He thrives on tackling technical problems, but his economics background gives him a unique understanding of business constraints and incentives around security initiatives._x000D_

_x000D_

Currently, as a Distinguished Engineer at Noname Security, Matt is evangelizing Noname’s ground-breaking API security platform and API security in general. Previously, he rolled out AppSec automation at USAA and founded 10Security. Early in his career, Matt served as Director of Community and Operations at the OWASP Foundation, Senior AppSec Engineer at Duo Security, Senior Software Security Engineer at Pearson and Senior Product Security Engineer at Rackspace._x000D_



Tracy Walker

DefectDojo

Principal Solution Architect

https://linkedin.com/in/tracyfwalker/



Tracy Walker is a 30-year veteran in Information Technology, go-lives, point-of-no-returns and hot-fixes. As a principal solutions architect for DefectDojo, Walker is passionate to help any I.T. environment improve security using open source and enterprise security tools.



Managed by the OWASP® Foundation

https://owasp.org/