Elevate Your Application Security Program with Burp Suite and ThreadFix

© 2017 Denim Group – All Rights Reserved

Elevate Your Application Security Program with BurpSuite Pro and ThreadFix

July 18th, 2017

Dan Cornell, CTO, Denim Group

Dafydd Stuttard, Director, PortSwigger Web Security


Agenda

1


Agenda

• BurpSuite Pro Background and Demo• ThreadFix Background• BurpSuite Pro and ThreadFix Together

2


BurpSuite Pro Background and Demo

3


ThreadFix Background

4


ThreadFix Overview• Create a consolidated view of your applications

and vulnerabilities

• Prioritize application risk decisions based on data

• Translate vulnerabilities to developers in the tools they are already using

5


ThreadFix Overview

6


Create a consolidated view of your applications

and vulnerabilities

7


Application Portfolio Tracking

8


Vulnerability Consolidation

9


Prioritize application risk decisions based on data

10


Vulnerability Prioritization

11


Prioritization with Hotspot

12


Reporting and Metrics

13


Translate vulnerabilities to developers in the tools they are already using

14


Defect Tracker Integration

15


BurpSuite Pro and ThreadFix Together

16


Hybrid Analysis Mapping• Merge BurpSuite Pro scan results with the

results of SAST

• Soon: Better imports of Burp Infiltrator for IAST/HAM-like capabilities

17


ThreadFix ScanAgent

• Drive BurpSuite Pro automated scanning from ThreadFix• One-time scans• Scheduled scans• CI/CD integration

18


Secure DevOps with ThreadFix

• What does your pipeline look like?

http://www.slideshare.net/mtesauro/mtesauro-keynote-appseceu http://www.slideshare.net/denimgroup/rsa2015-blending-theautomatedandthemanualmakingapplicationvulnerabilitymanagementyourally

https://blog.samsungsami.io/development/security/2015/06/16/getting-security-up-to-speed.html

19


AppSec Testing for DevOps

• Configuring Testing Policies

• AppSec Testing for DevOps in Action

20


Policy Configuration• Testing

• Synchronous• Asynchronous

• Decision• Reporting

Blog Post: Effective Application Security Testing in DevOps Pipelineshttp://www.denimgroup.com/blog/2016/12/effective-application-security-testing-in-devops-pipelines/

https://www.denimgroup.com/resources/effective-application-security-for-devops/

21


Testing Configuration

22


Testing Configuration

23


Decision Configuration

24


Decision Configuration

25


Reporting Configuration

26



27



28



29


Testing in Action

30


Testing in Action

31


Testing in Action

32


Testing in Action

33


Testing in Action

34


Testing in Action

35


Testing in Action

36


@denimgroupwww.threadfix.it

www.denimgroup.com

@Burp_Suitewww.portswigger.net

37

Technology

Elevate Your Application Security Program with Burp Suite and ThreadFix