Subscription

Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Learning Hub

Conferences

Free Learning

You're reading from Practical Security Automation and Testing Tools and techniques for automated security scanning and testing in DevSecOps

Product type Paperback

Published in Feb 2019

Publisher Packt

ISBN-13 9781789802023

Length 256 pages

Edition 1st Edition

Languages

C++

Tools

JMeter

Concepts

Application Security

Author (1):

Tony Hsiang-Chih Hsu

View More author details

Table of Contents (19) Chapters

Preface

1. The Scope and Challenges of Security Automation FREE CHAPTER

2. Integrating Security and Automation

3. Secure Code Inspection

4. Sensitive Information and Privacy Testing

5. Security API and Fuzz Testing

6. Web Application Security Testing

7. Android Security Testing

8. Infrastructure Security

9. BDD Acceptance Security Testing

10. Project Background and Automation Approach

11. Automated Testing for Web Applications

12. Automated Fuzz API Security Testing

13. Automated Infrastructure Security

14. Managing and Presenting Test Results

15. Summary of Automation Security Testing Tips

16. List of Scripts and Tools

17. Solutions

18. Other Books You May Enjoy

Leave a review - let other readers know what you think

Secure code review

For the source code security review, we listed common source code patterns of critical security issues and also risky APIs. Based on these security source patterns, we also introduced some open source tools to search these security issues.

What are common secure code review patterns and risky APIs?

The following table lists common keywords and patterns for secure code review:

Programming language	Risky API or the insecure code patterns		False positive
General	Weak encryption	`Blowfish \| DES \| 3DES \| RC4 \| MD5 \| SHA1 \| XOR \| ARC4 \| IDEA \| ECB \| CBC \| TLS 1.0 \| SSL 2.0 \| Base64 \| RIPEMD`	`Low`
	Insecure protocol	`SSL \| HTTP \| FTP \| Telnet`	`Low`
	Hard-coded info.	`Password \| IP address...`

The rest of the chapter is locked

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $19.99/month. Cancel anytime

Authors (1)

Hsu

Tony Hsiang-Chih Hsu is a senior security architect, software development manager, and project manager with more than 20 years' experience in security services technology. He has extensive experience of the Secure Software Development Lifecycle (SSDLC) in relation to activities including secure architecture/design review, secure code review, threat modeling, automated security testing, and cloud service inspection. He is also an in-house SDL trainer, having offered hands-on courses totaling in more than 300 hours. He is also the author of Hands-on Security in DevOps, and a co-author of several Open Web Application Security Project (OWASP) projects, including the OWASP testing guide, a proactive control guide, deserialization, cryptographic, and the XXE prevention cheatsheet.

See other products by Hsu