Enable DAST checks using OWASP Top 10 risk IDs as configuration
Currently individual checks in DAST can be enabled using the configuration DAST_CHECKS_TO_RUN which takes check IDs as input.
Proposal
Allow enabling a group of checks based on the OWASP top 10 categorisation of risks. For example, if a customer wants to test for "security misconfiguration", instead of going through the table of available checks and cross-referencing with the OWASP list, they can give A05 as an input to DAST to enable only those specific checks i.e. DAST_CHECKS_TO_RUN=A05.
This can help:
- make configuring checks in DAST easier by relying on domains enumerated by OWASP Top 10.
- allow customers to split their scans by domain (e.g. having a different CI job for A01 risks, A02 risks, ...) leading to concurrent results, and reduction in overall scan time.
Edited by Arpit Gogia