In my previous blog, I wrote about the challenges executives and developers are encountering while trying to integrate security tools and processes into the software development life cycle. Since then, I have done a bit research to identify and evaluate the market-leading product in the field of web application security scanning and believe I have a result worth sharing.
Overview
With over a third of global market share, Watchfire AppScan from IBM’s Rational family of products has to be considered the leading web application security scanner worldwide. AppsScan offers solutions for all types of security testing – outsourced, desktop-user and enterprise-wide analysis. Users of all kinds benefit from this application, including application developers, quality assurance teams, penetration testers, security auditors and senior management. AppScan’s engine seems to be quite powerful and capable of providing continuous monitoring and audit of web applications, testing for security and compliance issues, and delivery of reports with specific fix recommendations.
Vulnerability Detection
AppScan also seems to credibly provide security vulnerability detection through simulation of hacker attacks as Cross-Site Scripting; HTTP Response Splitting, Parameter Tampering, Hidden Field Manipulation. Backdoors/Debug Options, Stealth Commanding, Forceful Browsing, Application Buffer Overflow, Cookie Poisoning, SQL Injections, Content Spoofing, LDAP Injection, Xpath Injection and Session Fixation. In addition, AppScan maps to the Open Web Application Security Project (OWASP) Top 10 and to the SANS Top 20 vulnerabilities.
Reporting and Remediation
During a test, AppScan highlights the code that has been determined to be the cause of a specific vulnerability. Reasoning testing is provided in natural language to explain the logic of the test and why an issue was identified. Appscan delta analysis report provides you with the changes that have occurred from one scan to the next. The reported information includes what has been fixed and new security issues that have been introduced since the initial scan.
Support for a total of 40 global regulatory compliance and standards reporting is another interesting feature of this product. BASEL II, Electronic Fund and Transfer Act (EFTA), Payment Card Industry (PCI) Data Security Standards are among supported compliance and standards reporting.
Summing Up
AppScan (v7.5) looks like a valid option for helping to ensure the security and compliance of web applications throughout the software development life cycle. It's been designed for the broadest range of users, from business users to advanced power users who can utilize the added tools and API to create a customized scanning environment. In an upcoming blog I will provide more detailed information on the scanning abilities of AppScan as it pertains to building secure web applications – much more to come!
Recent Comments