IBM Application Security Insider

Out with the old, in with the new - IBM Security AppScan Standard 8.6 released!

If you’re the kind of person that likes taking a look under the hood, then get ready to dive into the new IBM Security AppScan Standard 8.6 and take a peek at what we did for this release.

By the end of this blog you’ll be convinced AppScan Standard 8.6 has some cool new features to help you do your job - download a trial and take it for a test drive.

First, let’s shortly summarize the main enhancements and improvement, and then delve into each one further:

• Next-Generation Dynamic Analysis Security Testing (DAST) Engine
• XSS Analyzer - the last word in XSS security testing
• Usability improvements
• Powerful utilities and integrations
• Additional advanced security testing capabilities:
  • Glass box automatically adjusts environmental definitions
  • JSA – integrated into the new engine, enabled in ASE.

The New Frontier - Securing Mobile Apps (WEBCAST)

Let's talk about mobile security, shall we?

We can see that smartphones and tablets are everywhere, taking their place as dominant collaboration devices in enterprises. Many organizations are struggling with understanding the implications of developing and deploying apps to new mobile platforms such as iOS and Android. Which risks should app developers be concerned with? What are the new vulnerabilities to test for, and how to find them effectively?

In this webcast I talk about this new frontier of application security, and discuss how IBM Security AppScan tools can help.

Click the following link to go to the webcast (registration required):

You may also read our new whitepaper "Ensuring application security in mobile device environments":

What are your thoughts about scanning for vunlerabilities in mobile apps? Leave a comment!

The Most Comprehensive Web Application Security Scanner Comparison Available Marks AppScan Standard as the Leader (Again)

Once again, AppScan has proven to be the leader of web application security testing tools, in a recent benchmark of over 60 commercial and open-source tools published by Shay Chen.

Attack vector comparison (taken from the WAVSEP benchmark review)

The benchmark covered several categories aimed to help choose the web application scanner right for you. A few of the more important categories are the different input vectors a scanner is capable of attacking, the different attack vectors that are in-effect used against the site, and the coverage features included in order to successfully crawl and scan the web application.
This is the 2nd year in a row that AppScan is found to be on top, and we are of course very excited, though not surprised due to AppScan's track record.

F4F Technology Helps You Analyze Applications For Security

By Babita Sharma, Michael Hua Xiao

Most modern web applications are built using web application frameworks, such as Enterprise JavaBeans (EJB), Apache Struts and JavaServer Faces (JSF). These frameworks simplify web application development by providing higher-level abstractions for common tasks. For example, many frameworks are based on the model-view-controller pattern and there is clear separation between business data storage, business rules configuration and the UI components of the application. In the framework-based web applications, the interactions between components are primarily invoked via configuration files and source code annotations. Interactions specified through configuration files are challenging to identify by traditional static analysis tools since they are not source code and vary from framework to framework. Without the information from configuration files, related control flow and data flow are missed and would lead to loss of vulnerability findings.

Framework for Frameworks (F4F) is an approach used by IBM Security AppScan Source to effectively analyze framework-based web applications. F4F processes configuration files and code annotations used by a framework-based application and extracts all the relevant information into a Web Application Flow Language (WAFL) file. WAFL is independent of any framework and program language. A WAFL file describes data flow and control flow extracted from configuration files.