April 2023
Beginner to intermediate
396 pages
8h 23m
Korean
Content preview from 자바 개발자를 위한 데브옵스 툴
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
238
자바 개발자를 위한 데브옵스 툴
스캐너가 검색한 약점과 피드백 결과 또한 신뢰도가 높다. 일관된 조사한 결과에 의하면 대부분의
DAST
툴이
OWASP
10
대 취약점
3
을 식별할 수 있다.
DAST
의 단점
DAST
툴은 다음과 같은 단점이 있다.
●
DAST
스캐너는 정해진 방식으로 웹 애플리케이션에 공격을 가하도록 프로그래밍되어 있다. 공격 기
법은 해당 제품에 대한 지식을 갖춘 보안 전문가가 설정하는 경우가 많다. 따라서 테스터 개인이 조율할
수 있는 부분이 거의 없다.
●
DAST
툴은 느리다. 분석을 완료하기까지 며칠이 걸리기도 한다.
●
DAST
툴은
SAST
가 조기에 발견할 수 있었던 일부 보안 갭을 개발 주기 최후반이 되어서야 감지할 수
있다. 따라서 문제 해결 비용은
SAST
에 비해 더 높다.
●
DAST
스캔은 알려진 버그를 기준으로 진행되며 새로운 유형의 공격은 상대적으로 오랜 기간을 두고
발견된다. 따라서
DAST
툴을 수정할 기회는 많지 않으며 실제로 수정하기도 어렵다. 새로운 공격 벡터
에 대한 지식과
DAST
툴의 내부 구현 원리에 대한 심층적인 이해가 함께 필요하기 때문이다.
7.3.3 7.3.3
SASTSAST
와 와
DASTDAST
의 차이의 차이
[표
7
-
1
]은
SAST
와
DAST
의 차이점을 요약해서 보여준다.
표
7-1 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.