Automating Cryptographic Vulnerability Analysis in the CI Toolchain

No ratings

Presented at InfoSecurityEurope 2019 by

Graham Cinkais

Accidental deployment of vulnerable cryptography can lead to significant data breaches - like the one that led to Uber paying a $200M fine in 2018. So companies in regulated industries are required to test their use of cryptography to standards such as PCI-DSS. But auditing crypto by hand is time-consuming, and error-prone. How can the process be automated to save time and money?In this talk, we explain how Cryptosense and 3Key Company helped a major international payments operator integrate automated cryptographic security testing into their CI pipeline, leveraging CS Analyzer and its Rest API. We discuss lessons learned along the way and tips for managing such integrations effectively, both at the technical and human level.Learning Outcomes:Learn how to add automated cryptographic vulnerability assessment to the CI toolchainImprove application security by using specialist cryptographic assessment tools Best practices for conducting automated cryptography auditsLearn how to demonstrate PCI-DSS compliance at the click of a button Save time and money on application security audits