Web application security testing techniques have changed significantly since waterfall development methodologies lost popularity and the advantages of an agile approach to software development started to hold sway. Testing has had to become as iterative as the continuous development & integration methods of modern app development. In environments with multiple web properties, the automation of such testing is now a commonplace necessity.

Sure, manual testing still exists — and there are excellent arguments for engineers to pore through lines of code manually. However, the increasing need for security combines with pressure on DevOps teams to get applications into production quickly to produce situations for testers that are at worst untenable and, at best, potentially dangerous for the organization’s assets.

There is continuing friction between SecOps and DevOps, with developers feeling held back by security teams and security professionals feeling pressured to rein in developer activities to keep the larger enterprise infrastructure safe.

There have been many thousands of words written about this dichotomy in organizations that thrive and survive on getting web apps to market (many of those words appearing on this very site). Most of them urge businesses to bake best security practices into every stage of app development. That’s a fine aim, but many individuals and departments still feel under massive pressure to hit targets: the temptation is to either circumvent security to some degree (for DevOps) or prevent the rapid progress of applications to production (for SecOps).

Whatever the circumstances, there is always some kind of compromise across both fronts — unless of course web applications can be tested effectively, promptly, and without significant resource drain. Here is where the AST models come into play, typically comprising today of dynamic and static application security testing processes (DAST and SAST).

Both have advantages and disadvantages, mainly around the numbers of false positives raised by automated testing routines, the extra resource overhead required in terms of engineer hours or processing power, and the cost and effort required to deploy an effective solution.

Then there’s the problem of CI/CD: the testing processes have to be continuous at all stages of development, from initial concept and wireframing right through production and version updates.

Here, a new generation of interactive application security testing (IAST) platforms helps teams both hit DevOps targets and address the pressing concerns of the security team. Netsparker by Invicti combines DAST and IAST to provide automated security testing that overcomes the traditional shortcomings of standalone DAST or SAST tools. The combined approach results in applications being crawled 100%, verifiable proof that risks are real, and pinpointed references to the exact line of code or stack trace of the vulnerability — precisely the type of information that developers need to address issues quickly and effectively.

This approach means vulnerabilities are quickly found and reported complete with remediation guidelines and sample attack payloads that could be used by real-life attackers, so there is as little impediment to development progress as possible. Netsparker is the objective voice that shows and proves which issues constitute a real risk and that must be addressed immediately. Apps can continue through their development cycles, and true security concerns can be sent directly to be fixed as part of the developers’ daily workflows in the tools they already use.

The platform’s configurable multiple scanning agents act as distributed instances to maximize test coverage but also minimize resource utilization. Each scanning agent reports vulnerabilities centrally with concrete proof that the issue is real and exploitable. Objectivity from this canonical source promotes collaboration between developers and security teams, even in very complex web portfolios that are under constant development and testing. Interdependencies and shared libraries, hidden files, and application-level exploits are proactively probed, as well as cross-site scripting (XSS), SQL injection, and other vulnerabilities that account for the bulk of cybersecurity incidents.

It’s worth noting that the Netsparker platform doesn’t require a clean slate or a lengthy deployment process. Security and development engineers can continue to use their existing tool stacks, so investment in these remains valid and their lifespan is extended, promoting better ROI over time. Netsparker integrates with existing ticketing systems, Git* platforms, messaging and communication software, and even works alongside pen test tools like Metasploit.

It offers team management and vulnerability management features as a platform in its own right: it’s a central reference point for all security testing on just about any web application, old or new.

In a further article here on Tech HQ, we’ll be taking a more in-depth look at Netsparker’s combined DAST and IAST approach to application security. Web applications continue to be excellent ways for organizations to interact with partners, suppliers, customers, and internal stakeholders. The latest advances in interactive application security testing help to ensure that both legacy and new instances are kept as secure as possible in the face of emerging threats.

You can request a demo of Netsparker by Invicti to speak to a technical resource about your organization’s specific testing needs.

AUSTIN, Texas, Oct. 13, 2020 /PRNewswire/ — Netsparker, the leading enterprise dynamic application security testing (DAST) solution, teamed up with Dimensional Research to understand the maturity and effectiveness of web application security in organizations worldwide. Security professionals from 382 organizations across the globe responded to the survey, with roles spanning development, DevOps, and C-suite. Netsparker analyzed the findings and today released a report, “New Vulnerability Found: Executive Overconfidence.”

The survey found numerous areas where executives believe their organizations are more secure or adhere to best practices at a higher rate than security professionals deeper in the organization. For example, 75% of executives believe their organization scans all web applications for security vulnerabilities, while nearly 50% of security staff say they don’t.

Even more concerning, over 60% of DevOps respondents indicate that new security vulnerabilities are being found faster than they can be fixed, indicating that web application security efforts are insufficient. However, only just over 40% of executives are aware of this situation, and thus most companies are unlikely to be making the required investments to remedy the situation.

Despite this, respondents ranked web application security highest among areas they believe their company should focus. Over 66% of respondents named web application security as a priority – more than any other aspect of IT security, ahead of network security, endpoint security, and patch management.

Additional highlights from the Netsparker report include:

While just 20% of developers believe that development teams are resistant to incorporating security, close to half of security professionals say they encounter developer resistance.
Just under 40% of developers indicated that critical security issues get automatically escalated, showing that organizations still have a long way to go to fully integrate security into the software development process.
Just under 35% of developers report friction caused by security false positives, compared to over 54% of security staff. This suggests that security teams bear the bulk of extra work caused by false alarms.
The survey shows a worrying disconnect between the theory and practice of web application security. While most organizations appreciate the importance of web security, many still don’t scan all their applications and an even greater number struggle to deal with vulnerabilities in a timely manner.

This research shows that perceptions and expectations of web application security vary widely depending on the role. This misalignment between perception and reality creates dangerous threats to the security of organizations and their customer’s data as well