Episode-467-Kim-Carter-on-Dynamic-Application-Security-Testing

Project Goals

The Purple Team project aims to enhance software security by providing developers with tools to create more secure applications. Kim Carter explains that the project began as a proof of concept using OWASP Zap, which was well-received by developers at various conferences 1. The project offers both a free OWASP version and a paid version, with the latter providing pre-configured infrastructure to save setup time 2. Carter emphasizes the project's role in reducing code defects and improving application security through dynamic application security testing 3.

The inspiration is basically just to help developers create a more secure software.

--- Kim Carter

   

Architecture

The architecture of the Purple Team involves a CLI that interacts with job files to orchestrate various tests. These job files define routes and fields for testing, while the orchestrator manages the execution of different testers 4. Kim Carter describes the dynamic nature of the system, where components like OWASP Zap act as emissaries to perform specific tasks 5. The project also considers integrating machine learning to refine test plans, aiming for more efficient and focused testing 6.

The orchestrator or the testers consult the ML module and then get back a refined set of directives.

--- Kim Carter

   

Implementation

Implementing the Purple Team into development pipelines is straightforward, as it is language-agnostic and can be integrated into any build system. Kim Carter notes that the CLI can be run headless for seamless integration into build pipelines 7. The project uses Redis for messaging, offering options like long polling to ensure message delivery even if the CLI goes offline 8. Additionally, there are plans to integrate with chat ops tools like Slack and Jira to automate reporting and task assignment 9.

If we're using long polling, we don't actually lose any messages when the CLI goes offline.

--- Kim Carter