Feeds:
Posts
Comments

Posts Tagged ‘Web Application Security’

unified-vulnerability-management-suite-espincorp.png

Background

With the recent Gartner published new market guide with the introduce of “container security” be part of the vulnerability management, Tenable be the only one possess that by bought over FlawCheck last year and introduce Tenable.io platform in the market, the market change again.
Tenable.io also introduce web application security (WAS) as part of the platform offering. With Container security and web application security, it now cross over to leading container security and enter into what we traditional called application security market (traditionally occupied by web vulnerability scanner and static source code analyzer vendor). Rapid7 from the past bought over NTO and enter into application security as well, by rebranding it as AppSpider product. We will expect all will catch up on the container security, most likely acquired existing player who offer it.
Technology keep changing from years, where from the past on the cloud and online, software as a service (SaaS) model, with emerge of Qualys as the leading player on that field. With the latest acquired and integration of other new technology take place, the real differentiator for major player become minimal, we can expected major vendor will try to introduce unique and specialized area and be differentiate themselves over another (take over, merger and acquisition is the obvious option for enter market rapidly) .
With application security in depth alone, traditionally Tenable do not enter in the past, where dominance by web application scanner offer dynamic , static application security testing technology (DAST, SAST) or new interactive application security testing (IAST). We can expect the market will be changing again.
Traditional vulnerability management or specialized web application scanner become more generic offering, and the price point is bring down significantly as technologies matured and more me-too product introduce in the market. Available of open sources alternative, let enterprise market who willing to paid for commercial offering being the primary target for all the commercial vendor.
We also saw the trend for traditional penetration testing tool vendor attempt to enter vulnerability management market. With the Rapid7 acquired Metasploit in the past and the recent Core Security make the vulnerability management offering.
We also see the trend for company used to offer SAST now try to enter DAST in application security field. For mobile application security testing (Mobile AST) as new technology also rising demand for today mobile application driven business.
On the other end, we saw the smaller vendor who previously focus on one tool product now day also attempt to expand their offering to large audience. Big player is extend their product with niche product/ to penetrate those previously recognize as niche as well.

Future of Vulnerability Management

Predicting for near future product-market

future-of-application-security-market.png

  • Mobile application security testing (Mobile AST) will be included in Application Security Testing (AST) tool market (together with DAST, SAST, IAST).
  • Container Security will be one of the unique, and slowly all the major player will incorporate into their offering (whether as a option or bundled).
  • Unified of vulnerability management and application security in the near future (and eliminate some of the player that can not transit over the new changing market reality).
  • Standalone and niche focus product that easy to be use continue to be play a role in the market for those who look for solving specific purpose, both generic and specialize product /tools continue to be available for those who need them.
  • Shift left (move from product security to software development) trend, more and more customer look for integrated tool to streamline the vulnerability/security fixing cycle as early as at the early development process.

security-risk-mnagement-SRM-espincorp.png

  • Trend toward threat/vulnerability management (VTM) slowly emerge and recognize as single unified process (threat assessment -> vulnerability assessment -> risk analysis) to streamline the whole process for address enterprise threat/vulnerability and risk analysis / security risk management (SRM).
The future of vulnerability management suite, depend on the end user requirement. For complex enterprise requirement, will include the above unified vulnerability management suite aspect/functional module or option in the package bundled.
As you can see for the market product shift underway, if you want to make any major decision for the short term, for sure, license subscription (LS) is the way to go, since it is pointless to own “outdated product” and pay significant investment upfront that you may or may not really found it relevant to the changed market at all.
E-SPIN Group being vulnerability management, application security and penetration testing product and solution provider for over 13 years in the market. E-SPIN will continue to be active in the business domain and helping customer to make right investment that yield return of investment.
Feel free to contact our E-SPIN solution consultant for any project or operation requirements.
Advertisements

Read Full Post »

Qualys Technical

For those who can not join us for the end user and channel partner product seminar session, please see the summary and highlight clip for the event.

For further information, please contact us or visit to our website on http://www.e-spincorp.com

Read Full Post »

Qualys

For those who can not join us for the end user and channel partner product seminar session, please see the summary and highlight clip for the event.

For further information, please contact us or visit to our website on http://www.e-spincorp.com

Read Full Post »

Hi Buddies!

For those who was not able to attend to the McAfee Vulnerability Manager Technical Overview by E-SPIN training,

please refer to the attached video above.

Enjoy it and stay tune for more video from us.

For further information, please contact us or visit to our website on http://www.e-spincorp.com

Read Full Post »

For those who are unable to attend the Acunetix v10 Whats New training event, here the extract video clip for the event. Product Demo is coming next. Stay tune.

Read Full Post »

mobileappsecuritytesting

75 percent of mobile app fail basic security tests

Through 2015, more than 75 percent of mobile applications will fail basic security tests, according to Gartner, Inc. Enterprise employees download from app stores and use mobile applications that can access enterprise assets or perform business functions, and these applications have little or no security assurances. These applications are exposed to attacks and violations of enterprise security policies.

Enterprises that embrace mobile computing and bring your own device (BYOD) strategies are vulnerable to security breaches unless they adopt methods and technologies for mobile application security testing and risk assurance. Most enterprises are inexperienced in mobile application security. Even when application security testing is undertaken, it is often done casually by developers who are mostly concerned with the functionality of applications, not their security.

Existing static application security testing (SAST) and dynamic application security testing (DAST) vendors solution will be inadequate unless willing to  modify and adjust these technologies to address mobile application cases and meet mobile application security testing challenges. Although SAST and DAST have been used for the past six to eight years and have become reasonably mature, mobile testing is a new space, even for these technologies. In addition to SAST and DAST, a new type of test, behavioral analysis, is emerging for mobile applications. The testing technology monitors a running application to detect malicious and/or risky behavior exhibited by an application in the background (e.g., when an audio player application plays music — at the same time, it also accesses a user’s contact list or geolocation, and initiates data transmission to some external IP address).

Testing the client layer — the code and graphical user interface (GUI) — of the mobile application that runs on the mobile device is not  enough. The server layer should be tested as well. Mobile clients communicate with servers to access an enterprise’s applications and databases. Failure to protect a server poses the risk of losing the data of hundreds of thousands of users from the enterprise’s databases. Code and user interfaces of these server-side applications should therefore be tested with SAST and DAST technologies.

Today, more than 90 percent of enterprises use third-party commercial applications for their mobile BYOD strategies, and this is where current major application security testing efforts should be applied. App stores are filled with applications that mostly prove their advertised usefulness. Nevertheless, enterprises and individuals should not use them without paying attention to their security. They should download and use only those applications that have successfully passed security tests conducted by specialized application security testing vendors.

By 2017, the focus of endpoint breaches will shift to tablets and smartphones. Enterprises should focus on data protection on mobile devices through usable and efficient solutions, such as application containment (via wrapping, software development kits or hardening).

Through 2017, 75 percent of mobile security breaches will be the result of mobile application misconfigurations, rather than the outcome of deeply technical attacks on mobile devices. A classic example of misconfiguration is the misuse of personal cloud service through apps residing on smartphones and tablets. When used to convey enterprise data, these apps lead to data leaks that the organization remains unaware for the vast majority.

E-SPIN End to End Mobile App Security Testing as a Service or Solution Package

E-SPIN’s Mobile App Security Testing service provides a detailed security analysis of your phone or tablet based app. A key feature of this service is commercial grade mobile application security testing tool will be used for systematic, automated and scalability approach to uncovers many more issues than human tests alone, in the large scale and continuous comparison required across the testing period.

Depend on the services or Solution Requirement scope, E-SPIN can be bundled with HTML5 Mobile Application Testing with your web application security testing as part of the bundled. The same is to cover the Server Operating System Vulnerability Assessment, Database Security Testing to provide comprehensive and end to end security testing. For customer with the Source Code intent to go thru Secure Code Review, can discuss about the scope and platform, E-SPIN can be deliver the entire solution as a Services, or solution package involved supply, training and active maintenance.

Cost & Duration

The duration of a test depends on the size and complexity of an app, but can start from 6 days (approx four days testing, two writing up).

To discuss your particular requirements, please contact us by email info(a)e-spincorp.com or phone our regional offices and partners.

Read Full Post »

As many as 70% of web sites have vulnerabilities that could lead to the theft of sensitive corporate data such as credit card information and customer lists.
Hackers are concentrating their efforts on web-based applications – shopping carts, forms, login pages, dynamic content, etc. Accessible 24/7 from anywhere in the world, insecure web applications provide easy access to backend corporate databases.
Firewalls, SSL and locked-down servers are futile against web application hacking!
Web application attacks, launched on port 80/443, go straight through the firewall, past operating system and network level security, and right into the heart of your application and corporate data. Tailor-made web applications are often insufficiently tested, have undiscovered vulnerabilities and are therefore easy prey for hackers.

acunetix-overview
Acunetix – a worldwide leader in web application security
Acunetix has pioneered the web application security scanning technology: Its engineers have focused on web security as early as 1997 and developed an engineering lead in website analysis and vulnerability detection.
Acunetix Web Vulnerability Scanner includes many innovative features:

AcuSensor Technology

  • An automatic client script analyser allowing for security testing of Ajax and Web 2.0 applications
  • Industries’ most advanced and in-depth SQL injection and Cross site scripting testing
  • Advanced penetration testing tools, such as the HTTP Editor and the HTTP Fuzzer
  • Visual macro recorder makes testing web forms and password protected areas easy
  • Support for pages with CAPTHCA, single sign-on and Two Factor authentication mechanisms
  • Extensive reporting facilities including VISA PCI compliance reports
  • Multi-threaded and lightning fast scanner crawls hundreds of thousands of pages with ease
  • Intelligent crawler detects web server type and application language
  • Acunetix crawls and analyzes websites including flash content, SOAP and AJAX
  • Port scans a web server and runs security checks against network services running on the server

Read Full Post »