GitLab GitLab Group Kickoffs - Secure:Dynamic Analysis, 16 Dec 2020

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Gitlab 13.8 kickoff - Secure:Dynamic Analysis

Description

Planning issue - https://gitlab.com/gitlab-org/gitlab/-/issues/294157
Direction page - https://about.gitlab.com/direction/secure/dynamic-analysis/dast/

A

Hi, this is derek ferguson senior product manager for the dynamic analysis group here at kit lab, and today, I'm going to be going over what we are working on in the 13 8 release of git lab, mostly, what we have going on is carryover from the 13.7 release.

A

The first thing that we are going to be delivering is the site validation for the on-demand scans, with this you'll be able to run active scans against your websites by proving that you own the website, there's a number of methods that you'll be able to use, starting out with the text file, validation, where you put a text file on your website and provide the path to us to validate that you were able to put the right text file there after that, you'll be able to see that any site profile using that underlying host name will be validated and you'll be able to run active, on-demand scans against those sites.

A

The second thing that we're going to be working on is adding remaining options to the site profile.

A

These will include whether you're able to select a website or rest api and then, as well as excluded, urls and request headers we've pulled the authentication site authentication out into the library to make it more clear, you're validating a host name instead of that single site profile.

A

The third thing we are going to be adding in aggregation of vulnerabilities that are noisy, provide more vulnerabilities for each website.

A

Each url in your website aggregating them into a single vulnerability so that you can easily manage that rather than having to go through hundreds or thousands of vulnerabilities, just to say that one single vulnerability was mitigated.

A

So this will help in managing the number of vulnerabilities found on the security report and the vulnerability report, as well as the dashboard. It will reduce the number of interactions that you have to go through in order to resolve all the vulnerabilities for a single project.

A

Those are the main things that we have going on for dash right now. We are working on several other things, including new integrations for browser and peach api security. However, those are long running items that will take multiple milestones in order to deliver fully. So that is all thank you very much have a great day.