DefectDojo at Global AppSec San Fran 2024

A quick overview and update on DefectDojo

1. OWASP

2. OWASP DefectDojo:
DevSecOps Single Source of Truth

3. Matt Tesauro

●Reformed programmer & AppSec Engineer
●CTO & Founder of DefectDojo Inc
●15+ years in the OWASP community
○OWASP DefectDojo (core maintainer)
○OWASP Podcast (host)
○OWASP Global Board of Directors
○OWASP AppSec Pipeline (co-leader)
○OWASP WTE (leader)
●22+ years using FLOSS and Linux
●Go language fanboy
●Ee Dan in Tang Soo Do
(2nd degree black belt)

4. Introduction
to DefectDojo
01

5. You’re “doing AppSec” and…
●It’s very likely you won’t have a full picture, especially at the start
●You need something that adapts and grows over time
●Tool vendors will have you log into 27 different web consoles
●What you really need is a single source of truth?
○Ability to normalize and hold all the data you need flexibly
○Ability to filter, sort, modify, combine the data
○Differing views based on stakeholders
○Dedup, False Positives, Grouping/Merging of findings

6. So, what solves these problems?
We surveyed AppSec, DevSecOps and Vuln Mgmt Pros and determined…

7. But WHY?

9. OWASP DefectDojo
DevSecOps tool created by DevSecOps professionals for DevSecOps professionals.

●Manages the DevSecOps security program
●Application inventory with robust metadata
●Sort, filter, munge and export the data in multiple ways
●Engagement / assessment tracking
●Supports manual and automated security work
●Customizable deduplication + false positive tracking of findings
●Custom report creation
●Tagging on multiple levels
●Calendar of security activities
●Historical knowledge of past assessments

10. OWASP DefectDojo

11. OWASP DefectDojo Pro (SaaS)

12. Active Project with a large Community
●Monthly minor version releases (2.x.0)
●Bugfix release every week in between (2.x.y)
●Top 20 open-source security index

13. Active Project with a large Community

14. 180+ Security Tools Supported

15. Install Options
Docker Compose
Community Contributed Helm Chart
Iron installs with godojo
AWS AMI
SaaS offering (supports the project)

16. DevSecOps &
DefectDojo
02

18. Manual Pen Tests
&
False Positive Analysis
Reporting & Metrics
Developer
Remediation
Security Orchestration
CI/CD Scanning

19. 840%
Increase
in
Efficiency

21. 15 Repos
4 Months
5,100 Runs
25,000+
Container Executions

22. Two places are better than one
Place #1
Tune the
profile of the
tool as much
as it will allow
Place #2
Mark False
Positives in
DefectDojo so
they don’t
flow further
downstream

23. DefectDojo
What’s next?
02

24. Changes and Improvements
●Recent deprecations
○MySQL as a supported database (July 2024)
○RabbitMQ as a supported message broker (July 2024)
○Integration with Google Sheets
●Increase testing across all supported features
○Only testable features make it into DefectDojo
○Changing out the framework behind our UI tests
○Increased API tests and diff’ing between releases
●Upgrade to newer Django Framework

26. Beta testing a new UI

27. Explore on your own

28. We have a booth!

29. Thanks!
Questions?

http://defectdojo.org

http://defectdojo.com

DefectDojo also at:
LinkedIn, X/Twitter, Github
OWASP’s Slack…