Hi, and a very warm welcome to this course,
Approaching Automated Security Testing in DevSecOps.
My name is Peter Mosmans, and I'm a lead penetration tester.
Let's start with a scenario.
Here's Maeve.
Maeve works for a large company, and let's call this company Globomantics,
Her company worked with DevOps,
and recently she heard some stuff about DevSecOps and,
in particular, automated security testing.
So now she wants to know what exactly automated security testing is,
and she's curious whether it's something for her company,
whether they can use it in order to improve their security.
She also wants to know how she should approach it,
how she could implement automated security testing at her company.
In order to answer those questions, Maeve turns to a consultant,
Jennifer, and Jennifer is going to help her answer the questions what it is,
what can be tested, whether it's the right fit for her company,
and, if so, how she should approach it.
And that's exactly this course is all about.
We'll start with understanding exactly what automated security testing is,
the definitions.
Then we'll dive deeper into the pros and cons of automated security testing.
Yes, there are also some drawbacks of using automated security testing.
And we'll finish this course with looking at understanding
what you can test and where exactly you should test it in
your software development lifecycle.
So what's in it for Maeve, and what might be in it for you?
Well, after this course,
you'll know all about what automated security testing is,
the pros and cons, what can be tested, what types of testing there are,
and whether it will fit in your company.
Who this course is for?
Mainly DevOps engineers, but also security professionals,
developers, product owners, Scrum masters,
and, of course, anyone interested in automated security testing.
One caveat though.
This course teaches concepts.
It handles about theory.
It doesn't have any demos.
It's about a concept.
How you implement it and integrate it will be
discussed in next courses on this path.
It doesn't sell you on DevSecOps, and it will not sell you on security testing.
It will deal with automated testing.
This course is part of the DevSecOps path
Approaching Automated Security Testing.
Other courses in this path,
Performing DevOps Security Testing and Integrating DevOps Security Testing,
dive deeper into automated security testing,
in particular, performing DevOps security testing looks on the tools,
which tools you can use and how,
and integrating DevOps security testing with how you can use it in your
CI/CD continuous integration/continuous development,
or deployment pipeline.
An overview from this module.
We'll start off with looking at what exactly automated security testing is,
the definition.
Then we'll look at the different types of security testing,
and in particular, we're going to look at static application security testing,
dynamic application security testing, and vulnerability scanning.
And we'll finish off this module with taking a look at
manual versus automated testing.
Since automated security testing is a big field,
here, once again,
an overview of exactly where this course fits into the bigger picture of
automated security testing and overall in the DevSecOps path.
We're here, Automated Security Testing,
and the automated security testing field is divided into three
different courses: Approaching Automated Security Testing,
the course you're watching right now; Performing Automated Security Testing,
which dives deeper into exactly which tools and what and how; and
Implementing DevSecOps Automated Security Testing,
where you learn how to hook the tooling into the
continuous integration/continuous deployment,
or development pipeline.
The approaching course is divided into three different modules:
Understanding Automated Security Testing,
Differentiating with Pros and Cons, and What and Where.
You're watching the first module, Understanding Automated Security Testing,
and this module deals with the definition,
the different types of testing, and manual versus automated testing.
That's a pretty big field, right?
So,
let's start with the definition of automated security testing in the next clip.