Refine
Year of publication
- 2022 (1)
Document Type
- Master Thesis (1)
Language
- English (1)
Has Fulltext
- yes (1)
Is part of the Bibliography
- no (1)
Keywords
- Continuous integration (1)
- Cybersecurity (1)
- DevSecOps (1)
- OWASP Top 10 (1)
Institute
DevSecOps has become a new paradigm in the technology world in a very short time. Despite the fact that there is a lot of talk about it, but in practice it is much more complicated. This paper shows one way to automate security testing on an established client-server application.
This research aims to find out if it is possible to improve quality standards by automating security testing and reducing human effort. One of the goals is to find reliable sources on information security management and practices known today. The next goal is to determine which components of the application to perform security analysis on.
We took the Open Web Application Security Project (OWASP) as a reliable source and began to examine the Top 10 web application security risks. The research needed to understand how this could be further applied to our client-server application.
As a result, we ran a manual experiment on the application following the OWASP Top 10 guidelines. After achieving some results in the manual experiment, we already had an idea of what to test and tools to automate.
We managed to automate 4 out of 10 categories, which took us about 2.5 months. On average, automated testing takes 38 minutes across 4 categories.
In conclusion, it should be noted that automating security testing costs a lot of effort and resources. Based on the example of our work, we can say for sure that it is necessary to properly prioritize resources and smoothly move to automation. The approach to cyber security analysis and automation will be different for each project. Nevertheless, information security in the vastness of the Internet was, is and will be, regardless of how technology evolves.