Subscribe
Despite the proliferation of application security testing (AST) tools in use today, most organizations knowingly or unknowingly push vulnerable code to production. Nearly 70% of respondents in a recent survey reported using 11 or more AST tools on more than half their codebase, and 69% of them rated the effectiveness of their security program as an 8 or higher on a scale of 1 to 10. And yet nearly 80% of the same organizations admitted to pushing code with known vulnerabilities to production at least occasionally (with nearly 50% admitting doing it regularly).
It’s no secret that software complexity and development speed are the main culprits here. Security teams simply can’t keep up. Manual security testing is incredibly complicated, and managing the vulnerability remediation cycles for everything those tests uncover multiplies the task. At the same time, malicious hackers are homing in on vulnerabilities in live web applications constantly. According to Forrester, applications are the most common attack vector, and web application exploits are the third-most-common type of attack.
Ideally, organizations would have an ever-increasing number of full-time security professionals whose only job is orchestrating scans and remediating vulnerabilities. But even if that were fiscally possible, the people qualified for that job are few and far between, and they are always overloaded.
So what’s an organization to do when the need to produce more applications more quickly collides with the need to secure them?
WhiteHat Dynamic has the answer
WhiteHat™ Dynamic is a software-as-a-service (SaaS) dynamic application security testing (DAST) solution that scans applications in their running environments, providing a real-time report of an organization’s attack surfaces and an a clear view of its true risk posture.
WhiteHat Dynamic requires no hardware or scanning software to be installed. It can be deployed quickly, it is scalable to fit any environment, and it matches any pace of development.
A modern DAST solution, WhiteHat Dynamic offers several key benefits for organizations.
- It provides visibility into exploitable vulnerabilities and risks.
- It automates the prioritization of results and highlights the most-critical vulnerabilities.
- It provides continuous and on-demand scanning to automatically detect vulnerabilities as web applications evolve, without any training required.
- It is production-safe, scanning apps without causing downtime or impacting user experience.
The future of DAST
With so many organizations running so many AST tools and yet remaining vulnerable to attack, it’s safe to say that security and development teams are not remediating all the findings their tools are flagging. Clearly, the best AST tools are the ones that get adopted, utilized, and responded to.
In a report by 451 Research, survey respondents identified the factors that inhibit AST tool use.
- Lack of staff expertise: 37%
- Solution complexity: 25%
- Complexity in setting up: 24%
- Solution usability: 23%
- Inadequate staffing: 20%
Unfortunately, legacy DAST tools deployed on-premises exacerbate many of these usability challenges because they require specialized staff to orchestrate the tools, define pathways, and confirm that vulnerabilities exist. They also make it difficult to test in production environments due to firewall and preproduction complexities. They require costly hardware to implement and run, and they require in-house maintenance, updates, and upgrades. These challenges lead to longer implementation times, inability to scale as needed, more cost with lower adoption, and reduced ROI.
By comparison, a cloud-based DAST solution such as WhiteHat Dynamic offers ease of use, scalability, and cost-effectiveness while ensuring absolute coverage. WhiteHat provides organizations with a way to improve their security program by offering a team of experienced security professionals that help build and run the DAST tool, and delivering reports that have near zero false positives. In this way, WhiteHat provides security teams with time to focus on tasks that can actually help manage an organization’s risks
Ease of use
Cloud-based DAST requires the URL of the website to scan. That’s it. The tool tests applications the way an attacker would: in their running environments, the way they were intended to run. Results are vetted to reduce false positives, so development teams don’t get buried in remediation efforts, increasing developer buy-in.
Scalability
As businesses grow and the number of web applications increase, security testing and remediation becomes exponentially more complex. Scaling the testing effort is often unfeasible due to resource and cost constraints. SaaS tools solve both issues with economy of scale: onboarding 100 web applications is the same as onboarding 10. WhiteHat Dynamic can onboard and test over 10,000 websites concurrently.
Absolute coverage
Creating and running a DAST tool is very time-consuming and resource-intensive. Furthermore, there is always a chance that the tool might not be configured correctly, exposing the organization to unwanted risk. Utilizing a SaaS tool like WhiteHat Dynamic gives organizations the ability to have absolute coverage without taking on the responsibility of configuring and running the tool, eliminating the risk of misconfigurations or partial coverage. This way, WhiteHat Dynamic can help organizations focus more on remediation rather than running the tool.
Cost-effectiveness
Anything that brings complexity also brings cost. On-premises solutions requiring personnel and hardware to implement and maintain will cost more than a cloud-based solution. Every organization has different needs, but it’s generally less expensive to outsource tooling and maintenance than to absorb it in-house.
Conclusion
Many organizations are realizing that their legacy AST tools are inadequate in today’s development environment. Most of these tools were developed exclusively for on-premises deployment. In addition to the onboarding and maintenance overheads, these legacy AST tools create bottlenecks for organizations, exhausting time and resources, and adding costs. Already-inundated development and security teams are forced to weed through boatloads of false positives, further eroding the trust between developers and security staff.
By implementing DAST as a SaaS solution, organizations can realize the benefits of testing web applications in their production environments without running up costs or overburdening in-house teams. The resulting benefits of ease of use, scalability, and cost-effectiveness make cloud-based DAST a no-brainer for organizations looking to scale their security coverage without sacrificing business growth.
Continue Reading
SANS report: Securing the shifting landscape of application development
