WebGoat for testing your Application Security tools

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "WebGoat for testing your Application Security tools"

Transcription

1 WebGoat for testing your Application Security tools NAISG-DFW February 28 th, 2012 Michael A Ortega, CISSP CEH CISM GCFA Sr Application Security Professional IBM Security Systems

2 Agenda Application Security testing technologies What is WebGoat and should you use it App Sec testing examples using AppScan Dynamic Static Best tips/practices for your deployment for your tools Q&A 2

3 Application Security Testing Technologies Static Analysis (White Box testing) Dynamic Analysis (Black Box testing) Runtime Analysis (Glass Box testing) Scan input Scans source code and bytecode for security and quality issues. Requires access to source or bytecode Scans running web applications. Requires starting point URL, and login credentials where relevant Similar to black box to scan running web applications with an agent installed on the application Assessment techniques Uses taint analysis and pattern matching techniques to locate issues Tampering of HTTP messages to locate application and infrastructure layer issues Agent monitors application performance during a black box scan for expanding threat coverage and greater detail Role in application development lifecycle Development: Scan code and work remediation from IDE Build: Scan nightly or weekly build to highlight defects for developers to correct Security: Define & customize security best practices for developers; Execute preproduction scans and audits Build: Scan as part of build acceptance tests before releasing build to testing team Test: Execute security test scripts as part of quality plan Security: Define test scripts for quality plan; Execute preproduction scans and audits Build: Provides added layer of vulnerability detail that assists developers with security debugging Security: Expands threat coverage for hard-to-identify vulnerabilities (including all OWASP Top 10) Results & Output Results are presented by line of code, source to sink functions flow Results are presented as HTTP messages (exploit requests) Results are presented as a combination of HTTP messages (exploit requests) and the line of code 3

4 What is WebGoat? WebGoat is a deliberately insecure J2EE web application maintained by OWASP designed to teach web application security lessons. * Web application security is difficult to learn and practice. Not many people have full blown web applications like online book stores or online banks that can be used to scan for vulnerabilities. In addition, security professionals frequently need to test tools against a platform known to be vulnerable to ensure that they perform as advertised. All of this needs to happen in a safe and legal environment * * Taken directly from the WebGoat project page 4

5 When should you use WebGoat you are new to Application Security testing you are evaluating Application Security tools your existing Application Security tools have had a major update or introduced a new feature you would like to test a global change with your existing Application Security solution You should not use WebGoat as your only criteria for selection a Application Security Testing solution 5

6 App Sec testing examples using AppScan Dynamic Static 6

7 Best Practices Determine best phased approach for your organization Security, QA and Development Collaborate on Policies and Approach Roles & Responsibility of each team Workflow between teams Official security strategy (i.e. all apps scanned and no high prior vulnerabilities) Agree on metrics to measure results and progress Formal Training/Enablement Plan Types of Security Vulnerabilities Analysis and triage skills Formal Solution training Identification of Security SME/Evangelist for Dev and QA Formation of security community Share best practices Share/create FAQs Ongoing informal enablement (i.e. lunch and learns) 7 Secure Your SDLC 7

8 Questions & Answers 8

9 References WebGoat Project Home Page: Install Guide: e_of_contents Web Application Security Consortium (WASC) Dynamic Scanner Selection Criteria: ecurity%20scanner%20evaluation%20criteria WASC Static Analysis Tool Evaluation Criteria (active): ol%20evaluation%20criteria 9

IBM Rational AppScan: Application security and risk management

IBM Rational AppScan: Application security and risk management IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM

More information

Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group

Securing Your Web Application against security vulnerabilities. Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Securing Your Web Application against security vulnerabilities Ong Khai Wei, IT Specialist, Development Tools (Rational) IBM Software Group Agenda Security Landscape Vulnerability Analysis Automated Vulnerability

More information

The Top Web Application Attacks: Are you vulnerable?

The Top Web Application Attacks: Are you vulnerable? QM07 The Top Web Application Attacks: Are you vulnerable? John Burroughs, CISSP Sr Security Architect, Watchfire Solutions jburroughs@uk.ibm.com Agenda Current State of Web Application Security Understanding

More information

Rational AppScan & Ounce Products

Rational AppScan & Ounce Products IBM Software Group Rational AppScan & Ounce Products Presenters Tony Sisson and Frank Sassano 2007 IBM Corporation IBM Software Group The Alarming Truth CheckFree warns 5 million customers after hack http://infosecurity.us/?p=5168

More information

Learning objectives for today s session

Learning objectives for today s session Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand what a black box and white box assessment is and how they differ Identify

More information

Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP

Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Black Box versus White Box: Different App Testing Strategies John B. Dickson, CISSP Learning objectives for today s session Understand different types of application assessments and how they differ Be

More information

Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis

Integrating Security into the Application Development Process. Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Integrating Security into the Application Development Process Jerod Brennen, CISSP CTO & Principal Security Consultant, Jacadis Agenda Seek First to Understand Source Code Security AppSec and SQA Analyzing

More information

IBM Innovate 2011. AppScan: Introducin g Security, a first. Bobby Walters Consultant, ATSC bwalters@atsc.com Application Security & Compliance

IBM Innovate 2011. AppScan: Introducin g Security, a first. Bobby Walters Consultant, ATSC bwalters@atsc.com Application Security & Compliance IBM Innovate 2011 Bobby Walters Consultant, ATSC bwalters@atsc.com Application Security & Compliance AppScan: Introducin g Security, a first June 5 9 Orlando, Florida Agenda Defining Application Security

More information

Adobe Systems Incorporated

Adobe Systems Incorporated Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...

More information

Fortify End User Training

Fortify End User Training Fortify End User Training Day 2: Labs VA SOFTWARE ASSURANCE PROGRAM OFFICE 1 Class Logistics Please mute your phones; conference line muted, #6 to unmute, *6 to mute Breaks approximately each hour, with

More information

New IBM Security Scanning Software Protects Businesses From Hackers

New IBM Security Scanning Software Protects Businesses From Hackers New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications

More information

Operationalizing Application Security & Compliance

Operationalizing Application Security & Compliance IBM Software Group Operationalizing Application Security & Compliance 2007 IBM Corporation What is the cost of a defect? 80% of development costs are spent identifying and correcting defects! During the

More information

Enterprise Application Security Program

Enterprise Application Security Program Enterprise Application Security Program GE s approach to solving the root cause and establishing a Center of Excellence Darren Challey GE Application Security Leader Agenda Why is AppSec important? Why

More information

OWASP Top Ten Tools and Tactics

OWASP Top Ten Tools and Tactics OWASP Top Ten Tools and Tactics Russ McRee Copyright 2012 HolisticInfoSec.org SANSFIRE 2012 10 JULY Welcome Manager, Security Analytics for Microsoft Online Services Security & Compliance Writer (toolsmith),

More information

Testing Web Application Scanner Tools Elizabeth Fong and Romain Gaucher NIST

Testing Web Application Scanner Tools Elizabeth Fong and Romain Gaucher NIST Testing Web Application Scanner Tools Elizabeth Fong and Romain Gaucher NIST Verify Conference Washington, DC, October 30, 2007 Disclaimer: Any commercial product mentioned is for information only; it

More information

IBM Rational AppScan: enhancing Web application security and regulatory compliance.

IBM Rational AppScan: enhancing Web application security and regulatory compliance. Strategic protection for Web applications To support your business objectives IBM Rational AppScan: enhancing Web application security and regulatory compliance. Are untested Web applications putting your

More information

Introduction. Secure Software Development 9/03/2015. Matias starts. Daan takes over. Matias takes over. Who are we? Round of introductions

Introduction. Secure Software Development 9/03/2015. Matias starts. Daan takes over. Matias takes over. Who are we? Round of introductions Matias starts Who are we? Applying Static Analysis Matias Madou and Daan Raman, Leuven, Feb 27, 2015 1 At NVISO, I m responsible for the software security practice. Next to the client work, I also leads

More information

Integrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper

Integrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper Integrating Application Security into the Mobile Software Development Lifecycle WhiteHat Security Paper Keeping pace with the growth of mobile According to the November 2015 edition of the Ericsson Mobility

More information

Web Application Vulnerability Scanning. VITA Commonwealth Security & Risk Management. April 8, 2016

Web Application Vulnerability Scanning. VITA Commonwealth Security & Risk Management. April 8, 2016 Web Application Vulnerability Scanning VITA Commonwealth Security & Risk Management April 8, 2016 1 Terms Threat A thing that can cause harm Vulnerability A flaw that can be exploited to cause bad things

More information

How to Build a Trusted Application. John Dickson, CISSP

How to Build a Trusted Application. John Dickson, CISSP How to Build a Trusted Application John Dickson, CISSP Overview What is Application Security? Examples of Potential Vulnerabilities Strategies to Build Secure Apps Questions and Answers Denim Group, Ltd.

More information

Establishing a Continuous Process for PCI DSS Compliance

Establishing a Continuous Process for PCI DSS Compliance Establishing a Continuous Process for PCI DSS Compliance Visa, MasterCard, American Express, and other payment card companies currently require all U.S. merchants accepting credit card payments to comply

More information

Security Automation in Agile SDLC Real World Cases

Security Automation in Agile SDLC Real World Cases Security Automation in Agile SDLC Real World Cases Ofer Maor Director of Security Strategy, Synopsys AppSec California, January 2016 Speaker Security Strategy at Synopsys Founder of Seeker / Pioneer of

More information

Security Testing and Vulnerability Management Process. e-governance

Security Testing and Vulnerability Management Process. e-governance Security Testing and Vulnerability Management Process for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India.

More information

Turning the Battleship: How to Build Secure Software in Large Organizations. Dan Cornell May 11 th, 2006

Turning the Battleship: How to Build Secure Software in Large Organizations. Dan Cornell May 11 th, 2006 Turning the Battleship: How to Build Secure Software in Large Organizations Dan Cornell May 11 th, 2006 Overview Background and key questions Quick review of web application security The web application

More information

Comparing Application Security Tools

Comparing Application Security Tools Comparing Application Security Tools Defcon 15-8/3/2007 Eddie Lee Fortify Software Agenda Intro to experiment Methodology to reproduce experiment on your own Results from my experiment Conclusions Introduction

More information

Building Assurance Into Software Development Life- Cycle (SDLC)

Building Assurance Into Software Development Life- Cycle (SDLC) Application Software Assurance Center of Excellence (ASACoE) Building Assurance Into Software Development Life- Cycle (SDLC) James Woody Woodworth Operations Chief, ASACoE & Sean Barnum, Principal Consultant

More information

THE HACKERS NEXT TARGET

THE HACKERS NEXT TARGET Governance and Risk Management THE HACKERS NEXT TARGET YOUR WEB AND SOFTWARE Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software ISC2 CyberSecurity Conference 09 Kuala

More information

Stories From the Front Lines: Deploying an Enterprise Code Scanning Program

Stories From the Front Lines: Deploying an Enterprise Code Scanning Program Stories From the Front Lines: Deploying an Enterprise Code Scanning Program Adam Bixby Manager Gotham Digital Science 10/28/2010 YOUR LOGO HERE Introduction Adam Bixby, CISSP, MS o Manager at Gotham Digital

More information

Application Code Development Standards

Application Code Development Standards Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards

More information

Security Testing of Java web applications Using Static Bytecode Analysis of Deployed Applications

Security Testing of Java web applications Using Static Bytecode Analysis of Deployed Applications Security Testing of Java web applications Using Static Bytecode Analysis of Deployed Applications Streamline your web application Security testing with IBM Security AppScan Source 9.0.1 Leyla Aravopoulos

More information

CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office

CSUSB Web Application Security Standard CSUSB, Information Security & Emerging Technologies Office CSUSB, Information Security & Emerging Technologies Office Last Revised: 03/17/2015 Draft REVISION CONTROL Document Title: Author: File Reference: CSUSB Web Application Security Standard Javier Torner

More information

Application Security Testing How to find software vulnerabilities before you ship or procure code

Application Security Testing How to find software vulnerabilities before you ship or procure code Application Security Testing How to find software vulnerabilities before you ship or procure code Anita D Amico, Ph.D. Hassan Radwan 1 Overview Why Care About Application Security? Quality vs Security

More information

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright

More information

Web Applications The Hacker s New Target

Web Applications The Hacker s New Target Web Applications The Hacker s New Target Ross Tang IBM Rational Software An IBM Proof of Technology Hacking 102: Integrating Web Application Security Testing into Development 1 Are you phished? http://www.myfoxny.com/dpp/your_money/consumer/090304_facebook_security_breaches

More information

Performing a Web Application Security Assessment

Performing a Web Application Security Assessment IBM Software Group Performing a Web Application Security Assessment 2007 IBM Corporation Coordinate the Time of the Audit Set up a time window with the application owner Inform your security team Inform

More information

Reducing Application Vulnerabilities by Security Engineering

Reducing Application Vulnerabilities by Security Engineering Reducing Application Vulnerabilities by Security Engineering - Subash Newton Manager Projects (Non Functional Testing, PT CoE Group) 2008, Cognizant Technology Solutions. All Rights Reserved. The information

More information

Integrating Tools Into the SDLC

Integrating Tools Into the SDLC Integrating Tools Into the SDLC FIRST Conference 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to

More information

Automatic vs. Manual Code Analysis

Automatic vs. Manual Code Analysis Automatic vs. Manual Code Analysis 2009-11-17 Ari Kesäniemi Senior Security Architect Nixu Oy ari.kesaniemi@nixu.com Copyright The Foundation Permission is granted to copy, distribute and/or modify this

More information

SAST, DAST and Vulnerability Assessments, 1+1+1 = 4

SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 SAST, DAST and Vulnerability Assessments, 1+1+1 = 4 Gordon MacKay Digital Defense, Inc. Chris Wysopal Veracode Session ID: Session Classification: ASEC-W25 Intermediate AGENDA Risk Management Challenges

More information

Standard: Web Application Development

Standard: Web Application Development Information Security Standards Web Application Development Standard IS-WAD Effective Date TBD Email security@sjsu.edu # Version 2.0 Contact Mike Cook Phone 408-924-1705 Standard: Web Application Development

More information

Production Security and the SDLC. Mark Kraynak Sr. Dir. Strategic Marketing Imperva mark@imperva.com

Production Security and the SDLC. Mark Kraynak Sr. Dir. Strategic Marketing Imperva mark@imperva.com Production Security and the SDLC Mark Kraynak Sr. Dir. Strategic Marketing Imperva mark@imperva.com Building Security Into the Development Process Production Test existing deployed apps Eliminate security

More information

HP Fortify application security

HP Fortify application security HP Fortify application security Erik Costlow Enterprise Security The problem Cyber attackers are targeting applications Networks Hardware Applications Intellectual Property Security Measures Switch/Router

More information

Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0

Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 Special Publication 500-269 Software Assurance Tools: Web Application Security Scanner Functional Specification Version 1.0 Paul E. Black Elizabeth Fong Vadim Okun Romain Gaucher Software Diagnostics and

More information

Building & Measuring Security in Web Applications. Fabio Cerullo Cycubix Limited 30 May 2012 - Belfast

Building & Measuring Security in Web Applications. Fabio Cerullo Cycubix Limited 30 May 2012 - Belfast Building & Measuring Security in Web Applications Fabio Cerullo Cycubix Limited 30 May 2012 - Belfast Brief Bio - CEO & Founder Cycubix Limited - 10+ years security experience in Technology, Manufacturing,

More information

Your Web and Applications

Your Web and Applications Governance and Risk Management Your Web and Applications The Hacker s New Target Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software Social Engineering in the Business

More information

Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications

Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications Detecting and Defending Against Security Vulnerabilities for Web 2.0 Applications Ray Lai, Intuit TS-5358 Share experience how to detect and defend security vulnerabilities in Web 2.0 applications using

More information

Starting your Software Security Assurance Program. May 21, 2015 ITARC, Stockholm, Sweden

Starting your Software Security Assurance Program. May 21, 2015 ITARC, Stockholm, Sweden Starting your Software Security Assurance Program May 21, 2015 ITARC, Stockholm, Sweden Presenter Max Poliashenko Chief Enterprise Architect Wolters Kluwer, Tax & Accounting Max leads the Enterprise Architecture

More information

Web application security Executive brief Managing a growing threat: an executive s guide to Web application security.

Web application security Executive brief Managing a growing threat: an executive s guide to Web application security. Web application security Executive brief Managing a growing threat: an executive s guide to Web application security. Danny Allan, strategic research analyst, IBM Software Group Contents 2 Introduction

More information

HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security

HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security The problem Cyber attackers are targeting applications

More information

1000 Projects later. Security Code Scans at SAP

1000 Projects later. Security Code Scans at SAP 1000 Projects later Security Code Scans at SAP About Us Ruediger Bachmann is a Development Architect at SAP AG working, as member of the central code analyses team, in the areas application security and

More information

Leveraging OWASP to Reduce Web App Data Breach Risk

Leveraging OWASP to Reduce Web App Data Breach Risk Leveraging OWASP to Reduce Web App Data Breach Risk P R E S E N T E D B Y J O H N VERRY P R I N C I P A L S E C U R I T Y C O N S U L T A N T P I V O T POINT SECURITY www.pivotpointsecurity.com Specialists

More information

WEB APPLICATION SECURITY

WEB APPLICATION SECURITY WEB APPLICATION SECURITY Governance and Risk Management YOUR LAST LINE OF DEFENSE Aug 06 2009 ANSES RAH RAH Anthony Lim MBA CISSP CSSLP FCITIL Director, Security, Asia Pacific Rational Software Prolog

More information

Continuous???? Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

Continuous???? Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. ???? 1 Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Application Delivery is Accelerating Surge in # of releases per app

More information

Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP

Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP Mean Time to Fix (MTTF) IT Risk s Dirty Little Secret Joe Krull, CPP, CISSP, IAM, CISA, A.Inst.ISP, CRISC, CIPP Presentation Overview Basic Application Security (AppSec) Fundamentals Risks Associated With

More information

Static & Dynamic Analysis for Web Applications. OWASP Atlanta Chapter March 2010 Meeting. The OWASP Foundation http://www.owasp.

Static & Dynamic Analysis for Web Applications. OWASP Atlanta Chapter March 2010 Meeting. The OWASP Foundation http://www.owasp. Static & Dynamic Analysis for Web Applications Tony UcedaVelez Atlanta, Chapter Lead & Guest Panel: Atlanta Chapter March 2010 Meeting Jeremiah Grossman (WhiteHat Security) Chris Eng (Veracode) Russell

More information

From the Bottom to the Top: The Evolution of Application Monitoring

From the Bottom to the Top: The Evolution of Application Monitoring From the Bottom to the Top: The Evolution of Application Monitoring Narayan Makaram, CISSP Director, Security Solutions HP/Enterprise Security Business Unit Session ID: SP01-202 Session 2012 Classification:

More information

Pentests more than just using the proper tools

Pentests more than just using the proper tools Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Penetration testing Introduction Evaluation scheme Security Analyses of web applications Internal Security

More information

Integrating Vulnerability Scanning into the SDLC

Integrating Vulnerability Scanning into the SDLC Integrating Vulnerability Scanning into the SDLC Eric Johnson JavaOne Conference 10/26/2015 1 Eric Johnson (@emjohn20) Senior Security Consultant Certified SANS Instructor Certifications CISSP, GWAPT,

More information

Web Application Remediation. OWASP San Antonio. March 28 th, 2007

Web Application Remediation. OWASP San Antonio. March 28 th, 2007 Web Application Remediation OWASP San Antonio March 28 th, 2007 Agenda Introduction The Problem: Vulnerable Web Applications Goals Example Process Overview Real World Issues To Address Conclusion/Questions

More information

Web Engineering Web Application Security Issues

Web Engineering Web Application Security Issues Security Issues Dec 14 2009 Katharina Siorpaes Copyright 2009 STI - INNSBRUCK www.sti-innsbruck.at It is NOT Network Security It is securing: Custom Code that drives a web application Libraries Backend

More information

Pentests more than just using the proper tools

Pentests more than just using the proper tools Pentests more than just using the proper tools Agenda 1. Information Security @ TÜV Rheinland 2. Security testing 3. Penetration testing Introduction Evaluation scheme Security Analyses of web applications

More information

Interactive Application Security Testing (IAST)

Interactive Application Security Testing (IAST) WHITEPAPER Interactive Application Security Testing (IAST) The World s Fastest Application Security Software Software affects virtually every aspect of an individual s finances, safety, government, communication,

More information

Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway

Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway Mingyu Web Application Firewall (DAS- WAF) - - - All transparent deployment for Web application gateway All transparent deployment Full HTTPS site defense Prevention of OWASP top 10 Website Acceleration

More information

Accelerating Software Security With HP. Rob Roy Federal CTO HP Software

Accelerating Software Security With HP. Rob Roy Federal CTO HP Software Accelerating Software Security With HP Rob Roy Federal CTO HP Software If we were in a cyberwar today, the United States would lose. Mike McConnell Former DNI, NSA. Head of Booz Allen Hamilton National

More information

Product Roadmap. Sushant Rao Principal Product Manager Fortify Software, a HP company

Product Roadmap. Sushant Rao Principal Product Manager Fortify Software, a HP company Product Roadmap Sushant Rao Principal Product Manager Fortify Software, a HP company Agenda Next Generation of Security Analysis Future Directions 2 Currently under investigation and not guaranteed to

More information

WebGoat evaluation and lesson development

WebGoat evaluation and lesson development WebGoat evaluation and lesson development Project specification Web application security Deltagare: Anto Cvitic, Kristoffer Svensk Handledare: Mads Dam Abstract WebGoat is a deliberately insecure web application

More information

Using Foundstone CookieDigger to Analyze Web Session Management

Using Foundstone CookieDigger to Analyze Web Session Management Using Foundstone CookieDigger to Analyze Web Session Management Foundstone Professional Services May 2005 Web Session Management Managing web sessions has become a critical component of secure coding techniques.

More information

Mobile Security Framework

Mobile Security Framework Automated Mobile Application Security Testing with Mobile Security Framework Ajin Abraham About Me! Security Consultant @ Yodlee! Security Engineering @ IMMUNIO! Next Gen Runtime Application Self Protection

More information

Moderator: Benjamin McGee, CISSP Cyber Security Lead SAIC

Moderator: Benjamin McGee, CISSP Cyber Security Lead SAIC From Security Assessment to Vulnerability Remediation: The Realities of Deploying a Cloud-Based Application Risk Management Solution Moderator: Benjamin McGee, CISSP Cyber Security Lead SAIC Setting the

More information

The IBM Rational AppScan lifecycle solution: building Web application security into software and systems delivery.

The IBM Rational AppScan lifecycle solution: building Web application security into software and systems delivery. Strategic protection for Web assets To support your business objectives The IBM Rational AppScan lifecycle solution: building Web application security into software and systems delivery. Are online vulnerabilities

More information

Web Application security testing: who tests the test?

Web Application security testing: who tests the test? Web Application security testing: who tests the test? Ainārs Galvāns Application Penetration Tester www.exigenservices.lv About myself Functional testing Leading test group Reporting to client Performance

More information

The New OWASP Testing Guide v4

The New OWASP Testing Guide v4 The New OWASP Testing Guide v4 Matteo Meucci OWASP Testing Guide Co-lead 17 th March 2015 Security Summit - OWASP-Italy Matteo Meucci OWASP: OWASP-Italy Founder and Chair from 2005 OWASP Testing Guide

More information

EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA

EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA EFFECTIVE VULNERABILITY SCANNING DEMYSTIFYING SCANNER OUTPUT DATA Paul R. Lazarr, CISSP, CISA, CIPP, CRISK Sr. Managing Consultant, IBM Cybersecurity and Biometrics January 21, 2016 PERSONAL BACKGROUND

More information

Strategic Information Security. Attacking and Defending Web Services

Strategic Information Security. Attacking and Defending Web Services Security PS Strategic Information Security. Attacking and Defending Web Services Presented By: David W. Green, CISSP dgreen@securityps.com Introduction About Security PS Application Security Assessments

More information

Application Security and the SDLC. Dan Cornell Denim Group, Ltd. www.denimgroup.com

Application Security and the SDLC. Dan Cornell Denim Group, Ltd. www.denimgroup.com Application Security and the SDLC Dan Cornell Denim Group, Ltd. www.denimgroup.com Overview Background What is Application Security and Why is It Important? Specific Reference Examples Integrating Security

More information

El costo oculto de las aplicaciones Vulnerables. Faustino Sanchez. WW Security Sales Enablement. IBM Canada

El costo oculto de las aplicaciones Vulnerables. Faustino Sanchez. WW Security Sales Enablement. IBM Canada El costo oculto de las aplicaciones Vulnerables. Faustino Sanchez. WW Security Sales Enablement. IBM Canada The Traditional Approach is Changing. Security is no longer controlled and enforced through the

More information

Development Testing for Agile Environments

Development Testing for Agile Environments Development Testing for Agile Environments November 2011 The Pressure Is On More than ever before, companies are being asked to do things faster. They need to get products to market faster to remain competitive

More information

R&D Security Training. Based on materials from OWASP

R&D Security Training. Based on materials from OWASP R&D Security Training Based on materials from OWASP Agenda Reasons for IT Security The web application security challenge 10 Most Critical Risks (OWASP Top 10) Security Development Lifecycle (SDL) Security

More information

Web Application Report

Web Application Report Web Application Report This report includes important security information about your Web Application. Security Report This report was created by IBM Rational AppScan 8.5.0.1 11/14/2012 8:52:13 AM 11/14/2012

More information

Security Testing for Developers using OWASP ZAP

Security Testing for Developers using OWASP ZAP JavaOne San Fransisco 2014 The OWASP Foundation http://www.owasp.org Security Testing for Developers using OWASP ZAP Simon Bennetts OWASP ZAP Project Lead Mozilla Security Team psiinon@gmail.com Copyright

More information

Abstract. Introduction. Summary

Abstract. Introduction. Summary Analyzing the Effectiveness and Coverage of Web Application Security s By Larry Suto Application Security Consultant San Francisco October, 2007 Abstract This paper summarizes my study of web application

More information

Application Security Program Management with Vulnerability Manager

Application Security Program Management with Vulnerability Manager Application Security Program Management with Vulnerability Manager Bryan Beverly June 2 nd, 2010 Today's Presentation The challenges of application security scanning and remediation What Vulnerability

More information

Copyright 2006. Watchfire Corporation. All Rights Reserved.

Copyright 2006. Watchfire Corporation. All Rights Reserved. AppScan Frequently Asked Technical Questions 1. How is AppScan different from other web application scanners? (p. 2) 2. How do I know if I ve covered all of my applications? (p. 3) 3. How is AppScan different

More information

Braindumps.C2150-810.50 questions

Braindumps.C2150-810.50 questions Braindumps.C2150-810.50 questions Number: C2150-810 Passing Score: 800 Time Limit: 120 min File Version: 5.3 http://www.gratisexam.com/ -810 IBM Security AppScan Source Edition Implementation This is the

More information

Web Application Penetration Testing

Web Application Penetration Testing Web Application Penetration Testing 2010 2010 AT&T Intellectual Property. All rights reserved. AT&T and the AT&T logo are trademarks of AT&T Intellectual Property. Will Bechtel William.Bechtel@att.com

More information

QA Classroom and Online training from Yes-M Systems

QA Classroom and Online training from Yes-M Systems QA Classroom and Online training from Yes-M Systems One of the best QA courses: Manual Testing Highlights 85+ hours to finish the course Experienced Instructors Recruiters help with Resume Preparation

More information

Making your web application. White paper - August 2014. secure

Making your web application. White paper - August 2014. secure Making your web application White paper - August 2014 secure User Acceptance Tests Test Case Execution Quality Definition Test Design Test Plan Test Case Development Table of Contents Introduction 1 Why

More information

Magento Security and Vulnerabilities. Roman Stepanov

Magento Security and Vulnerabilities. Roman Stepanov Magento Security and Vulnerabilities Roman Stepanov http://ice.eltrino.com/ Table of contents Introduction Open Web Application Security Project OWASP TOP 10 List Common issues in Magento A1 Injection

More information

Getting Started with Web Application Security

Getting Started with Web Application Security Written by Gregory Leonard February 2016 Sponsored by Veracode 2016 SANS Institute Since as far back as 2005, 1 web applications have been attackers predominant target for the rich data that can be pulled

More information

Ed Adams, CEO Security Innovation. Dr. Larry Ponemon Ponemon Institute. 2012 ISACA Webinar Program. 2012 ISACA. All rights reserved.

Ed Adams, CEO Security Innovation. Dr. Larry Ponemon Ponemon Institute. 2012 ISACA Webinar Program. 2012 ISACA. All rights reserved. 2012 Study on Application Security: AS Survey of fits Security and dd Developers Ed Adams, CEO Security Innovation Dr. Larry Ponemon Ponemon Institute 2012 ISACA Webinar Program. 2012 ISACA. All rights

More information

Practical Defense with Mod Security Web Application Firewall (WAF)

Practical Defense with Mod Security Web Application Firewall (WAF) Practical Defense with Mod Security Web Application Firewall (WAF) Marian Ventuneac marian.ventuneac@gmail.com October 25 th, 2013 whoami Security Architect CISM, CISA with Genworth Financial Member of

More information

Early Vulnerability Detection for Supporting Secure Programming

Early Vulnerability Detection for Supporting Secure Programming Early Vulnerability Detection for Supporting Secure Programming Luciano Sampaio - lsampaio@inf.puc- rio.br Alessandro Garcia - afgarcia@inf.puc- rio.br OPUS Research Group LES DI PUC- Rio - Brazil OPUS

More information

IBM Rational Software

IBM Rational Software IBM Rational Software Development Conference 2008 Augmenting Dynamic Application Security Testing with Static Analysis Dan Cornell Principal, Denim Group, Ltd. dan@denimgroup.com AS14 2007 IBM Corporation

More information

Application Security Testing

Application Security Testing Tstsec - Version: 1 09 July 2016 Application Security Testing Application Security Testing Tstsec - Version: 1 4 days Course Description: We are living in a world of data and communication, in which the

More information

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011

Bridging the Gap - Security and Software Testing. Roberto Suggi Liverani ANZTB Test Conference - March 2011 Bridging the Gap - Security and Software Testing Roberto Suggi Liverani ANZTB Test Conference - March 2011 1 Agenda Roberto, what test are you doing? Is this a defect, vulnerability or both? What can we

More information

HackMiami Web Application Scanner 2013 PwnOff

HackMiami Web Application Scanner 2013 PwnOff HackMiami Web Application Scanner 2013 PwnOff An Analysis of Automated Web Application Scanning Suites James Ball, Alexander Heid, Rod Soto http://www.hackmiami.org Overview Web application scanning suites

More information

Introduction to Application Security. Trinity University Computer Science. September 18 th, 2008

Introduction to Application Security. Trinity University Computer Science. September 18 th, 2008 Introduction to Application Security Trinity University Computer Science September 18 th, 2008 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From Here?

More information

Driving Quality, Security and Compliance in Third- Party Code

Driving Quality, Security and Compliance in Third- Party Code Driving Quality, Security and Compliance in Third- Party Code Dave Gruber Director of Product Marketing, Black Duck Keri Sprinkle Sr Product Marketing Manager, Coverity Jon Jarboe Sr Technical Marketing

More information

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda

Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda Secure Web Application Coding Team Introductory Meeting December 1, 2005 1:00 2:00PM Bits & Pieces Room, Sansom West Room 306 Agenda 1. Introductions for new members (5 minutes) 2. Name of group 3. Current

More information