Automated Finding Correlation where do SAST, DAST and IAST overlap

The presentation discusses the benefits of using correlation in cybersecurity and DevOps to reduce the amount of work needed to resolve issues and prioritize them.

• Using correlation can reduce the amount of work needed to resolve issues and prioritize them
• Correlation can consolidate multiple issues into a single one
• Data-driven prioritization and remediation can be achieved through correlation
• Actual numbers show a significant reduction in the amount of issues after consolidation
• The industry now focuses on fixing issues rather than just detecting them

The presentation provides an example of how correlation was used on the Web Goat application to identify multiple vulnerabilities caused by the same weak link in the code. The correlation process was able to compress and consolidate multiple issues into a single one, reducing the amount of issues from 80 to 1.

Abstract:Did you ever wonder what is the overlap between different scanning technologies? why should you use few different technologies, and is there a single technology to rule them all?Well, we did wonder about this exact topic and decided to once and for all find an answer.We knew that the information included in an IAST finding can be used to uniquely identify issues reported by DAST and SAST. We have built an automated correlation service that goes over vulnerabilities reported by the three technologies and automatically matches findings.In this session, you will learn about our findings. Did we find a significant overlap? which issue types are more common to be detected by one technology over the other? and is there one technology to rule them all?You will also learn about the value such correlation brings, whether you are a developer or security expert, and how using more technologies can actually reduce your work and shorten the time for remediation.