Ben Pick
DevOps & Software Security Consultant
Coveros
location_on United States
Member since 7 years
Share
Ben Pick
Specialises In (based on submitted proposals)
Ben is a security analyst with 5 years experience in a background ranging from coding development to compliance and system monitoring. With a focus in security, Ben has developed coding standards and methodologies that were implemented on previous projects by the development teams. He has experience in designing tests to find weaknesses in applications, both in their business logic and functionality. He has a familiarity with a variety of tools used to harden enterprise environments, such as Tripwire, AppScan Standard, Snort, and Fortify.
-
keyboard_arrow_down
How to test for the new OWASP Top 10 Vulnerabilities
10 Mins
Talk
Beginner
The latest version of the OWASP Top 10 Vulnerabilities is about to be finalized. This talk discusses how to use these guidelines, both old and new, to perform security testing. In too many instances, security is the last phase of the SDLC. Using the OWASP Top 10 list, developers and testers can become more aware of potential vulnerabilities. This will improve their coding and testing skills, allowing them to build more robust code.
This presentation discusses each of the latest vulnerabilities defined in the 2017 version of the OWASP Top 10. It includes testing strategies or failure scenarios which lead to exploitation. Best practices are discussed, all within the condensed time frame of a 10 minute firetalk.
-
-
keyboard_arrow_down
Testing for Security: The oft forgotten aspect of DevOps
45 Mins
Talk
Intermediate
Agile development and DevOps churn through testing at a rate that is impossible for a human to keep up with. Security tools are often designed to have someone at the helm, targeting the systems and applications or performing time intensive penetration tests.
What if there were a way to layer in security as applications are being developed? It is unreasonable to believe that automation can completely replace a knowledgeable security tester, but much of the groundwork and preliminary analysis can be incorporated into the software lifecycle.
If nothing else, these tools and methods will help prevent completing an application, only to discover security findings that cannot be resolved before being released.
-
-
No more submissions exist.
