Is your software secure?
|
|
- Amber Thornton
- 8 years ago
- Views:
Transcription
1 Is your software secure? HP Fortify Application Security VII konferencja Secure 2013 Warsaw - October 9, 2013 Gunner Winkenwerder Sales Manager Fortify CEE, Russia & CIS HP Enterprise Security +49 (172) Skype: GCHW-HPESP gunnner.winkenwerder@hp.com 1 Copyright Copyright Hewlett-Packard Development Company, Company, L.P. L.P. The information The information contained contained herein herein is subject is subject to change to change without without notice. notice.
2 Cyber crime is increasing Threats and risks are expanding in frequency, intensity and sophistication 2 Copyright 2012 Hewlett-Packard Development Company, L.P.
3 Why Software Is Attacked Root cause of security problems Gartner 82% of breaches due to security flaws in software NIST 92% of vulnerabilities are in software RSA % of successful breaches happen on application layer Cenzic 99% of web applications are vulnerable to attac Yet, 90% of security spending is on perimeter protection Hardware Software & Data Intellectual Property OBJECTIVE: Protect everything Network Customer Data OBJECTIVE: Exploit one vulnerability Business Processes Trade Secrets 3
4 The Growing Cost of Cyber Crime! Despite widespread awareness of the impact of cyber crime, cyber attacks continue to occur more frequently and result in serious Cyber financial threats and consequences. risks are expanding The HP Ponemon in : 2012 Cost of Cyber Crime Study revealed that cyber attacks have Frequency more than doubled and the financial impact has increased by nearly 40 percent in a three year Intensity period. At HP, we believe a better understanding of the cost of cyber crime can assist organizations Sophistication in taking proactive measures to identify, combat and mitigate the potentially devastating consequences Cost of an attack. 4
5 When should we address software security? As early as possible! 5
6 Basic components of a mature SSA program 6
7 Fortify Application Security Assessments Delivery Options On Demand On Premise HP Fortify on Demand HP Fortify SSC 7
8 Continuous Security Research (SRG, DV Labs etc.) Update the Fortify/ESP Secure Coding Rulepacks to identify the latest categories of software vulnerabilities on a quarterly basis Growth in Vulnerability Categories , 563 Categories to Date 21 Supported Programming Languages SCA, Binary & FoD 8 Command Injection Privacy Violation Session Fixation SQL Injection System Information Leak Unhandled Exception LDAP Injection Cross-Build Injection Cross-Site Request Forgery Cross-Site Scripting HTTP Response Split JavaScript Hijacking For a complete list go to: plus more than supported API s/frameworks ABAB * Actionscript ASP.NET Java C, C++ C# COBOL* Cold Fusion * T-SQL PL/SQL JavaScript/AJAX, XML/HTML Classic ASP JSP PHP Python * VB.NET VBScript VB6 Objective C (IOS)
9 HP Fortify Source Code Analyzer (SCA) Architectural Overview 9
10 Best-Practice Implementation (Example) Development Teams AWB 2. Audit Repeat Bug Tracker Security Monitor Project Security Lead 3. Assign Development Manager Developer 4. Fix Source Code Repository(s) Central Build Server(s) Build Tool Fortify SCA 1. Identify Fortify SSC Fortify SSC Server CISO 5. Validate for Release AWB Security Tester 10
11 Innovation Driven by Major Customer Deployments Banking & Finance Infrastructure Public & Government Healthcare E-commerce & Retail Telco & Energy Other 11
12 Gartner Magic Quadrant 2013 HP Fortify is Leader in Application Security Testing HP offers comprehensive SAST capabilities with Fortify's strong brand name and breadth of languages tested. The company has innovative IAST capability with Fortify SecurityScope, which integrates with its WebInspect DAST. There is strong integration within HP's security portfolio, such as integration of AST knowledge into ArcSight and DAST knowledge into TippingPoint's IPS for WAF-like protection. HP uniquely offers runtime application self-protection (RASP) technology (see "Runtime Application Self- Protection: A Must-Have, Emerging Security Technology"). 12
13 Sneak Pre-View: Look & Feel HP Fortify SCA - Audit Work Bench (AWB) & - Integrated Dev. Environment (IDE) Copyright 2012 Hewlett-Packard Development Company, L.P.
14 The Scanning Process waiting until the scan is completely finished. 14
15 Auditing (AWB and IDE) - Overview Functions and Rulewriting wizard (only in AWB) Filtering Priorization Categorization Overview Issue - Groups 15
16 Auditing (AWB and IDE) Trace the issue Sourcecode Analysis Trace Diagram 16
17 Auditing (AWB and IDE) - Result Store Analysis See other comments and make comments yourself File a bug 17
18 Auditing (AWB and IDE) Training on the job Detailed description of the issue 18
19 Auditing (AWB and IDE) Training on the job Detailed recommendation to fix the issue 19
20 HP Fortify Software Security Center WebInspect (GUI) Copyright 2012 Hewlett-Packard Development Company, L.P.
21 Live scan visualization Start remediation of vuln s immediately Live Scan Dashboard Site tree Live Scan Statistics 21 Excluded and Allowed Hosts Section Copyright 2012 Hewlett-Packard Development Company, L.P. Vulnerabilities found in application Detailed Attack Table
22 Fortify my Application HP Fortify on Demand (FoD) assessment services is offering a limited free trial where customers can get an example Java code of theirs assessed free of charge. The free FoD is out of California but is accessible from anywhere. The following are the limitations on the free version: Up to 5 assessments per month Java and.net only Up to 75 MB per assessment Cross-Site Scripting (Up to 10 vulnerabilities) Access: In the menu on the right there's a link to TRY NOW: 22 Copyright 2012 Hewlett-Packard Development Company, L.P.
23 Thank you Gunner Winkenwerder Sales Manager Fortify CEE, Russia & CIS HP Enterprise Security +49 (172) Skype: GCHW-HPESP 23
Product Roadmap. Sushant Rao Principal Product Manager Fortify Software, a HP company
Product Roadmap Sushant Rao Principal Product Manager Fortify Software, a HP company Agenda Next Generation of Security Analysis Future Directions 2 Currently under investigation and not guaranteed to
More informationHP Fortify Software Security Center
HP Fortify Software Security Center Proactively Eliminate Risk in Software Trust Your Software 92% of exploitable vulnerabilities are in software National Institute for Standards and Technology (NIST)
More informationInformation Security: Enabling the Business Developing an Effective Application Security Program
Information Security: Enabling the Business Developing an Effective Application Security Program Bruce C Jenkins (bcj@hp.com) AppSec Program Strategist 04 April 2014 About me Commonwealth IT Security Conference
More informationHP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security
HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security The problem Cyber attackers are targeting applications
More informationHP Yazılım Zirvesi - İstanbul 20 May 2015 - Wyndham Grand Levent Burak DAYIOĞLU, Hüseyin ÖZEL Uygulamalarım Ne Kadar Güvende?
HP Yazılım Zirvesi - İstanbul 20 May 2015 - Wyndham Grand Levent Burak DAYIOĞLU, Hüseyin ÖZEL Uygulamalarım Ne Kadar Güvende? Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained
More informationFortify. Securing Your Entire Software Portfolio
Fortify 360 Securing Your Entire Software Portfolio Fortify Fortify s holistic approach to application security truly safeguards our enterprise against today s ever-changing security threats. Craig Schumard,
More informationChanging the Enterprise Security Landscape
Changing the Enterprise Security Landscape Petr Hněvkovský Presales Consultant, ArcSight EMEA HP Enterprise Security Products 2012 Hewlett-Packard Development Company, L.P. The information contained herein
More informationHP ESP Partner Enablement Fortify Proof of Concept Boot Camp Training
HP ESP Partner Enablement Fortify Proof of Concept Boot Camp Training HP and HP Enterprise Security Products are committed to your success as an HP Partner. In the Fortify Proof of Concept Boot Camp Training,
More informationРешения HP по информационной безопасности
Решения HP по информационной безопасности Евгений Нечитайло ynechyta@hp.com Mobile: +380 67 464 0218 Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
More informationHP Fortify application security
HP Fortify application security Erik Costlow Enterprise Security The problem Cyber attackers are targeting applications Networks Hardware Applications Intellectual Property Security Measures Switch/Router
More informationApplication Code Development Standards
Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards
More informationSecurity Operation Centre 5th generation
Security Operation Centre 5th generation transition Cezary Prokopowicz Regional Manager SEE HP Enterprise Security Products 2 3 4 5 Challenges you are facing 1 Nature and motivation of attacks (Fame to
More informationBe Fast, but be Secure a New Approach to Application Security July 23, 2015
Be Fast, but be Secure a New Approach to Application Security July 23, 2015 Copyright 2015 Vivit Worldwide Copyright 2015 Vivit Worldwide Brought to you by Copyright 2015 Vivit Worldwide Hosted by Paul
More informationA Strategic Approach to Web Application Security The importance of a secure software development lifecycle
A Strategic Approach to Web Application Security The importance of a secure software development lifecycle Rachna Goel Technical Lead Enterprise Technology Web application security is clearly the new frontier
More informationFrom the Bottom to the Top: The Evolution of Application Monitoring
From the Bottom to the Top: The Evolution of Application Monitoring Narayan Makaram, CISSP Director, Security Solutions HP/Enterprise Security Business Unit Session ID: SP01-202 Session 2012 Classification:
More informationSTATE OF WASHINGTON DEPARTMENT OF SOCIAL AND HEALTH SERVICES P.O. Box 45810, Olympia, Washington 98504 5810. October 21, 2013
STATE OF WASHINGTON DEPARTMENT OF SOCIAL AND HEALTH SERVICES P.O. Box 45810, Olympia, Washington 98504 5810 October 21, 2013 To: RE: All Vendors Request for Information (RFI) The State of Washington, Department
More informationBusiness white paper. Missioncritical. defense. Creating a coordinated response to application security attacks
Business white paper Missioncritical defense Creating a coordinated response to application security attacks Table of contents 3 Your business is under persistent attack 4 Respond to those attacks seamlessly
More informationApplication Security Center overview
Application Security overview Magnus Hillgren Presales HP Software Sweden Fredrik Möller Nordic Manager - Fortify Software HP BTO (Business Technology Optimization) Business outcomes STRATEGY Project &
More informationAccelerating Software Security With HP. Rob Roy Federal CTO HP Software
Accelerating Software Security With HP Rob Roy Federal CTO HP Software If we were in a cyberwar today, the United States would lose. Mike McConnell Former DNI, NSA. Head of Booz Allen Hamilton National
More informationEl costo oculto de las aplicaciones Vulnerables. Faustino Sanchez. WW Security Sales Enablement. IBM Canada
El costo oculto de las aplicaciones Vulnerables. Faustino Sanchez. WW Security Sales Enablement. IBM Canada The Traditional Approach is Changing. Security is no longer controlled and enforced through the
More information應 用 SIEM 偵 測 與 預 防 APT 緩 攻 擊
應 用 SIEM 偵 測 與 預 防 APT 緩 攻 擊 HP Enterprise Security 林 傳 凱 (C. K. Lin) Senior Channel PreSales, North Asia HP ArcSight, Enterprise Security 1 Rise Of The Cyber Threat Enterprises and Governments are experiencing
More informationHP Application Security Center
HP Application Security Center Web application security across the application lifecycle Solution brief HP Application Security Center helps security professionals, quality assurance (QA) specialists and
More informationThe Evolution of Enterprise Application Security. Why enterprises need runtime application self-protection
The Evolution of Enterprise Application Security Why enterprises need runtime application self-protection 2 Abstract Enterprise information security encompasses a broad set of disciplines and technologies,
More informationGetting Started with Web Application Security
Written by Gregory Leonard February 2016 Sponsored by Veracode 2016 SANS Institute Since as far back as 2005, 1 web applications have been attackers predominant target for the rich data that can be pulled
More informationFortify Training Services. Securing Your Entire Software Portfolio FRAMEWORK*SSA
Fortify Training Services Securing Your Entire Software Portfolio FRAMEWORK*SSA Fortify s holistic approach to application security truly safeguards our enterprise against today s ever-changing security
More informationSecure in 2010? Broken in 2011! Matias Madou, PhD Principal Security Researcher
Secure in 2010? Broken in 2011! Matias Madou, PhD Principal Security Researcher Matias Madou Principal Security Researcher, Fortify an HP Company Static Analysis Rules Insider Threat Research Runtime products:
More informationHP ENTERPRISE SECURITY. Protecting the Instant-On Enterprise
HP ENTERPRISE SECURITY Protecting the Instant-On Enterprise HP SECURITY INTELLIGENCE AND RISK MANAGEMENT PLATFORM Advanced Protection Against Advanced Threats 360 Security Monitoring to Detect Incidents
More informationApplication Security Testing Powered by HPE Fortify on Demand. Managed application security testing available on demand
Application Security Testing Powered by HPE Fortify on Demand Managed application security testing available on demand Powered by HPE Fortify on Demand, Sogeti Application security testing is a managed
More informationImproving your Secure SDLC ( SSDLC ) with Prevoty. How adding real-time application security dramatically decreases vulnerabilities
Improving your Secure SDLC ( SSDLC ) with Prevoty How adding real-time application security dramatically decreases vulnerabilities February 2015 Improving your Secure SDLC ( SSDLC ) with Prevoty Table
More informationTesting Solutions to Tackle Application Security Checkpoint Technologies SQGNE. Jimmie Parson Checkpoint Technologies
Testing Solutions to Tackle Application Security Checkpoint Technologies SQGNE Jimmie Parson Checkpoint Technologies Welcome, Introductions Agenda Checkpoint Technologies Quick Corporate Overview Why do
More informationTHE EVOLUTION OF ENTERPRISE APPLICATION SECURITY
THE EVOLUTION OF ENTERPRISE APPLICATION SECURITY THE EVOLUTION OF ENTERPRISE APPLICATION SECURITY Why enterprises need runtime application self-protection 2 ABSTRACT Enterprise information security encompasses
More informationApplication Backdoor Assessment. Complete securing of your applications
Application Backdoor Assessment Complete securing of your applications Company brief BMS Consulting is established as IT system integrator since 1997 Leading positons in Eastern Europe country Product
More informationIBM Rational AppScan: Application security and risk management
IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM
More informationIMPROVING VULNERABILITY MANAGEMENT EFFECTIVENESS WITH APPLICATION SECURITY MONITORING
IMPROVING VULNERABILITY MANAGEMENT EFFECTIVENESS WITH APPLICATION SECURITY How runtime application security monitoring helps enterprises make smarter decisions on remediation 2 ABSTRACT Enterprises today
More informationThe Evolution of Application Monitoring
The Evolution of Application Monitoring Narayan Makaram, CISSP, Director, Solutions Marketing, HP Enterprise Security Business Unit, May 18 th, 2012 Rise of the cyber threat Enterprises and Governments
More information2,000 Websites Later Which Web Programming Languages are Most Secure?
2,000 Websites Later Which Web Programming Languages are Most Secure? Jeremiah Grossman Founder & Chief Technology Officer 2010 WhiteHat Security, Inc. WhiteHat Security Founder & Chief Technology Officer
More informationWeb application security Executive brief Managing a growing threat: an executive s guide to Web application security.
Web application security Executive brief Managing a growing threat: an executive s guide to Web application security. Danny Allan, strategic research analyst, IBM Software Group Contents 2 Introduction
More informationHP ESP 2013 Solution Roadmap
HP ESP 2013 Solution Roadmap C. K. Lin ( 林 傳 凱 ) Senior Channel Solution Manager, North Asia ck.lin@hp.com March 8, 2013 資 安 要 聞 議 程 HP ESP 簡 介 HP ESP 解 決 方 案 HP ESP 2013 Solution Roadmap Q&A HP ESP 簡
More informationWork smarter, not harder, to secure your applications Featuring Analyst Research
1 Issue 2 1 2 3 9 Seismic shift needed toward application security Critical differentiator for RASP Access to the code From the Gartner Files: Maverick* Research: Stop Protecting Your Apps; It s Time for
More informationIT Security & Compliance. On Time. On Budget. On Demand.
IT Security & Compliance On Time. On Budget. On Demand. IT Security & Compliance Delivered as a Service For businesses today, managing IT security risk and meeting compliance requirements is paramount
More informationSecuring Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group
Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability
More informationIntegrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper
Integrating Application Security into the Mobile Software Development Lifecycle WhiteHat Security Paper Keeping pace with the growth of mobile According to the November 2015 edition of the Ericsson Mobility
More informationWhat s New in HP Fortify Software Security Center 4.20
What s New in HP Fortify Software Security Center 4.20 September 2014 This release of HP Fortify Software Security Center includes the 10.30 release of WebInspect and WebInspect Enterprise. The WebInspect
More informationSix Essential Elements of Web Application Security. Cost Effective Strategies for Defending Your Business
6 Six Essential Elements of Web Application Security Cost Effective Strategies for Defending Your Business An Introduction to Defending Your Business Against Today s Most Common Cyber Attacks When web
More informationContinuous???? Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
???? 1 Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Application Delivery is Accelerating Surge in # of releases per app
More informationApplication Security Testing How to find software vulnerabilities before you ship or procure code
Application Security Testing How to find software vulnerabilities before you ship or procure code Anita D Amico, Ph.D. Hassan Radwan 1 Overview Why Care About Application Security? Quality vs Security
More informationWe protect you applications! No, you don t. Digicomp Hacking Day 2013 May 16 th 2013
We protect you applications! No, you don t Digicomp Hacking Day 2013 May 16 th 2013 Sven Vetsch Partner & CTO at Redguard AG www.redguard.ch Specialized in Application Security (Web, Web-Services, Mobile,
More informationBringing Security Testing to Development. How to Enable Developers to Act as Security Experts
Bringing Security Testing to Development How to Enable Developers to Act as Security Experts Background: SAP SE SAP SE Business Software Vendor Over 68000 employees Worldwide development Myself Security
More informationNetwork Test Labs (NTL) Software Testing Services for igaming
Network Test Labs (NTL) Software Testing Services for igaming Led by committed, young and dynamic professionals with extensive expertise and experience of independent testing services, Network Test Labs
More informationBraindumps.C2150-810.50 questions
Braindumps.C2150-810.50 questions Number: C2150-810 Passing Score: 800 Time Limit: 120 min File Version: 5.3 http://www.gratisexam.com/ -810 IBM Security AppScan Source Edition Implementation This is the
More informationMagic Quadrant for Application Security Testing
G00246914 Magic Quadrant for Application Security Testing Published: 2 July 2013 Analyst(s): Neil MacDonald, Joseph Feiman The market for application security testing is changing rapidly. Technology trends,
More informationTOOL EVALUATION REPORT: FORTIFY
TOOL EVALUATION REPORT: FORTIFY Derek D Souza, Yoon Phil Kim, Tim Kral, Tejas Ranade, Somesh Sasalatti ABOUT THE TOOL Background The tool that we have evaluated is the Fortify Source Code Analyzer (Fortify
More informationHP TIPPINGPOINT ADAPTIVE REAL-WORLD SECURITY. Stefan Schmid Sales Manager Central & Eastern Europe & Middle East s.schmid@hp.com
HP TIPPINGPOINT ADAPTIVE REAL-WORLD SECURITY Stefan Schmid Sales Manager Central & Eastern Europe & Middle East s.schmid@hp.com 2010 2011 Hewlett-Packard Development Company, L.P. The information contained
More informationelearning for Secure Application Development
elearning for Secure Application Development Curriculum Application Security Awareness Series 1-2 Secure Software Development Series 2-8 Secure Architectures and Threat Modeling Series 9 Application Security
More informationMagic Quadrant for Application Security Testing
G00246914 Magic Quadrant for Application Security Testing Published: 2 July 2013 Analyst(s): Neil MacDonald, Joseph Feiman The market for application security testing is changing rapidly. Technology trends,
More informationIJMIE Volume 2, Issue 9 ISSN: 2249-0558
Survey on Web Application Vulnerabilities Prevention Tools Student, Nilesh Khochare* Student,Satish Chalurkar* Professor, Dr.B.B.Meshram* Abstract There are many commercial software security assurance
More informationHP NonStop Server Security and HP ArcSight SIEM
HP NonStop Customer Technical Talk HP NonStop Server Security and HP ArcSight SIEM 04/12/2012 HP NonStop Karen Copeland HP Enterprise Security Morgan DeRodeff XYPRO Barry Forbes NonStop Enterprise Division
More informationApplication Security Testing. Jesper Kråkhede
Application Security Testing Jesper Kråkhede AST 2015-10-22 2 Others call it security and try to avoid it I call it passion and dive right into it Jesper Kråkhede Worked as a security consultant for 17
More informationSoftware security, by the numbers. October 20, 2015
Software security, by the numbers October 20, 2015 Why are we here? 2 Chris Wysopal, CTO & Co-Founder 15+ years focused solely on application security One of the original security researchers from mid
More informationFind the intruders using correlation and context Ofer Shezaf
Find the intruders using correlation and context Ofer Shezaf Agenda The changing threat landscape What can you do to find intruders? Best practices for timely detection and mitigation HP ArcSight 2 Find
More informationAssuring Application Security: Deploying Code that Keeps Data Safe
Assuring Application Security: Deploying Code that Keeps Data Safe Assuring Application Security: Deploying Code that Keeps Data Safe 2 Introduction There s an app for that has become the mantra of users,
More informationThe purpose of this report is to educate our prospective clients about capabilities of Hackers Locked.
This sample report is published with prior consent of our client in view of the fact that the current release of this web application is three major releases ahead in its life cycle. Issues pointed out
More informationSTATE OF SOFTWARE SECURITY
STATE OF SOFTWARE SECURITY Focus on Application Development SUPPLEMENT TO VOLUME 6 03 VERACODE State of Software Security Report, Supplement to Volume 6: Focus on Application Development CONTENTS Introduction
More informationA Strategic Approach to Web Application Security
WhiteHat Security White Paper A Strategic Approach to Web Application Security Extending security across the entire software development lifecycle Jerry Hoff Vice President, Static Code Analysis Division
More informationMobile Application Security Study
Report Mobile Application Security Study 2013 report Table of contents 3 Report Findings 4 Research Findings 4 Privacy Issues 5 Lack of Binary Protection 5 Insecure Data Storage 5 Transport Security 6
More informationRuntime Application Self Protection (RASP) Making Applications Self Protecting, Self Diagnosing and Self Testing
Runtime Application Self Protection (RASP) Making Applications Self Protecting, Self Diagnosing and Self Testing The cyber security landscape has become increasingly complex in recent years. Threats include
More informationHTML5 SECURITY. Why Should I Care? Ofer Shezaf, ofr@hp.com Product Manager, Security Solutions HP ArcSight
HTML5 SECURITY Why Should I Care? Ofer Shezaf, ofr@hp.com Product Manager, Security Solutions HP ArcSight 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change
More informationBezpečnosť dát v HP Cloude
Bezpečnosť dát v HP Cloude Ochrana dát a súkromia v cloudových službách Február 2013 Agenda TRENDY RIEŠENIA HP PRÍKLADY 2 Security awareness at board level Security leadership is under immense pressure
More information5 Partner Benefits and Requirements... 8 5.1 Benefits... 8 5.2 Requirements... 8
Table of Contents Table of Contents... 2 1 Overview & Presentation... 4 2 Partner Communications... 5 2.1 Partner channels... 5 2.2 Kiuwan Representatives... 5 3 About Kiuwan... 6 4 Partner Types... 7
More informationPrevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management
Prevent cyber attacks. SEE what you are missing. See Your Network MAP. Prevent Cyber Attacks. Driven by the need to support evolving business objectives, enterprise IT infrastructures have grown increasingly
More informationHow to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
More informationSAST, DAST and Vulnerability Assessments, 1+1+1 = 4
SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges
More informationInteractive Application Security Testing (IAST)
WHITEPAPER Interactive Application Security Testing (IAST) The World s Fastest Application Security Software Software affects virtually every aspect of an individual s finances, safety, government, communication,
More informationExcellence Doesn t Need a Certificate. Be an. Believe in You. 2014 AMIGOSEC Consulting Private Limited
Excellence Doesn t Need a Certificate Be an 2014 AMIGOSEC Consulting Private Limited Believe in You Introduction In this age of emerging technologies where IT plays a crucial role in enabling and running
More informationStarting your Software Security Assurance Program. May 21, 2015 ITARC, Stockholm, Sweden
Starting your Software Security Assurance Program May 21, 2015 ITARC, Stockholm, Sweden Presenter Max Poliashenko Chief Enterprise Architect Wolters Kluwer, Tax & Accounting Max leads the Enterprise Architecture
More informationPrevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management
Prevent cyber attacks. SEE what you are missing. See Your Network MAPS. Prevent cyber attacks. [RedSeal] is meeting our expectations and is playing an integral role as it feeds right into our overall risk
More informationThe Top Web Application Attacks: Are you vulnerable?
QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding
More informationThe Convergence of IT Security and Compliance with a Software as a Service (SaaS) approach
The Convergence of IT Security and Compliance with a Software as a Service (SaaS) approach by Philippe Courtot, Chairman and CEO, Qualys Inc. Information Age Security Conference - London - September 25
More informationMagic Quadrant for Static Application Security Testing
Magic Quadrant for Static Application Security Testing Gartner RAS Core Research Note G00164100, Joseph Feiman, Neil MacDonald, 6 February 2009, R2997 02102010 In this research, we analyze the static application
More informationIntegrated Threat & Security Management.
Integrated Threat & Security Management. SOLUTION OVERVIEW Vulnerability Assessment for Web Applications Fully Automated Web Crawling and Reporting Minimal Website Training or Learning Required Most Accurate
More informationWeb application testing
CL-WTS Web application testing Classroom 2 days Testing plays a very important role in ensuring security and robustness of web applications. Various approaches from high level auditing through penetration
More informationIBM Rational AppScan Source Edition
IBM Software November 2011 IBM Rational AppScan Source Edition Secure applications and build secure software with static application security testing Highlights Identify vulnerabilities in your source
More informationPCI Solution for Retail: Addressing Compliance and Security Best Practices
PCI Solution for Retail: Addressing Compliance and Security Best Practices Executive Summary The Payment Card Industry (PCI) Data Security Standard has been revised to address an evolving risk environment
More informationPASTA Abstract. Process for Attack S imulation & Threat Assessment Abstract. VerSprite, LLC Copyright 2013
2013 PASTA Abstract Process for Attack S imulation & Threat Assessment Abstract VerSprite, LLC Copyright 2013 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
More informationBest Practices - Remediation of Application Vulnerabilities
DROISYS APPLICATION SECURITY REMEDIATION Best Practices - Remediation of Application Vulnerabilities by Sanjiv Goyal CEO, Droisys February 2012 Proprietary Notice All rights reserved. Copyright 2012 Droisys
More informationThreat Modeling. Categorizing the nature and severity of system vulnerabilities. John B. Dickson, CISSP
Threat Modeling Categorizing the nature and severity of system vulnerabilities John B. Dickson, CISSP What is Threat Modeling? Structured approach to identifying, quantifying, and addressing threats. Threat
More informationTHE BLIND SPOT IN THREAT INTELLIGENCE THE BLIND SPOT IN THREAT INTELLIGENCE
THE BLIND SPOT IN THREAT INTELLIGENCE THE BLIND SPOT IN THREAT INTELLIGENCE How application threat intelligence can make existing enterprise security infrastructures smarter THE BLIND SPOT IN THREAT INTELLIGENCE
More informationSTATE OF SOFTWARE SECURITY
STATE OF SOFTWARE SECURITY Volume 6: Focus on Industry Verticals JUNE 2015 03 VERACODE State of Software Security Report, Volume 6: Focus on Industry Verticals CONTENTS Introduction by Chris Wysopal, Veracode
More information05.0 Application Development
Number 5.0 Policy Owner Information Security and Technology Policy Application Development Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 5. Application Development
More informationCritical Capabilities for Application Security Testing
G00270805 Critical Capabilities for Application Security Testing Published: 17 August 2015 Analyst(s): Joseph Feiman, Neil MacDonald Global-scale scandals around applications' breaches make application
More informationBlack Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP
Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand different types of application assessments and how they differ Be
More informationCaaS Think as a bad guy Petr Hněvkovský, CISA, CISSP HP Enterprise Security
CaaS Think as a bad guy Petr Hněvkovský, CISA, CISSP HP Enterprise Security 1 Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.
More informationSWASCAN ALL in ONE. SWASCAN Web Application SWASCAN Network SWASCAN Code Review
SWASCAN ALL in ONE SWASCAN Web Application SWASCAN Network SWASCAN Code Review SWASCAN at a Glance The first Cloud Suite Security Platform The right way to manage the Security Risk, both for web and mobile
More informationSolutions to Meet Your PCI Compliance Needs A whitepaper prepared by Coalfire Systems and HP
Solutions to Meet Your PCI Compliance Needs A whitepaper prepared by Coalfire Systems and HP 1 P a g e Table of Contents Executive Summary... 3 The Payment Card Industry Data Security Standard... 3 PCI
More information(S2.3) Security Spotlight: How cyber criminals can steal millions in seconds and how to fight back. Johannesburg
(S2.3) Security Spotlight: How cyber criminals can steal millions in seconds and how to fight back Johannesburg Bharat Mistry Security Chief Technologist HP Enterprise Security Tweet using #HPWorldZA Johannesburg
More informationHP Fortify Static Code Analyzer
HP Fortify Static Code Analyzer Software Version 4.10 Installation and Configuration Guide Document Release Date: April 2014 Software Release Date: April 2014 Legal Notices Warranty The only warranties
More informationPassing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
More informationSECURE APPLICATION DEVELOPMENT CODING POLICY OCIO-6013-09 TABLE OF CONTENTS
OFFICE OF THE CHIEF INFORMATION OFFICER OCIO-6013-09 Date of Issuance: May 22, 2009 Effective Date: May 22, 2009 Review Date: TABLE OF CONTENTS Section I. PURPOSE II. AUTHORITY III. SCOPE IV. DEFINITIONS
More informationThe monsters under the bed are real... 2004 World Tour
Web Hacking LIVE! The monsters under the bed are real... 2004 World Tour Agenda Wichita ISSA August 6 th, 2004 The Application Security Dilemma How Bad is it, Really? Overview of Application Architectures
More information