Automatic versus manual. A heavily debated subject whatever you speak of, and it is no different in the web application security industry. Should you do a manual penetration test or automatically scan all your websites with an automated web application security scanner? With which process you would find most vulnerabilities and which one has the best return on investment?

In reality you need a bit of both. Actually, with today’s complex web application you cannot do without automation. By automating the majority of a penetration test, i.e. scan your website with a web vulnerability scanner you ensure that the security audits are more accurate, detect more vulnerabilities and save time. And when you save time you keep costs lows and have enough time to finalize the penetration test with a manual check for logical vulnerabilities.

In this article I will walk you through the different stages of a web application penetration test which help in highlighting the fact that automation is a must in web application security.

Web Application Coverage – Identifying the Attack Surface

The first thing you do before auditing the security of a website is find all the possible attack surfaces, or as they are also called possible point of entries. Attack surfaces can be input fields such as those found in contact forms, shopping carts and login forms, parameters in the URL and also hidden parameters in the code. Now let’s keep in mind that a typical medium sized modern web application can have hundreds or even thousands of such inputs and many of which are very difficult to identify.

An automated web application security scanner such as Netsparker has a crawler component which is specifically built for this purpose; to crawl the web application and identify all possible attack surfaces so they can be checked if they are vulnerable to cross-site scripting, SQL injectionand other type of web application vulnerabilities and security issues. Typically the scanner crawls such a website in less than an hour and automatically identifies all attack surfaces. Would you do this manually? In theory yes you can. In practise? Definitely not! It would take days, even weeks for a seasoned penetration tester to accomplish such a task, not to mention the high chances of missing input fields.

It is very important to identify all possible attack surfaces, else not all can be tested. And a malicious attacker only needs to find one vulnerable input field to hack a web application.

Identifying Vulnerabilities and Security Flaws in a Timely Manner

During an automated web application security scan each possible attack surface is checked for hundreds of different vulnerabilities within a few hours. The same as with the crawling, it is impossible to do such task manually.

A typical modern and small web application can contain at least 100 possible attack surfaces. If it takes a security professional at least a minute to complete each test (and he needs to be really good and quick to do it that fast) it will still take him around 83 working hours to test each input parameter for at least 50 different vulnerability variants. That is roughly 10 man days of checking for routine things. This is an unsustainable amount of time, and task.

We humans are prone to make mistakes especially when we do repetitive but yet complex work, while automated tools are build to do exactly that. Take advantage of such tools and alwaysautomated the repetitive in web application security.

Identifying More Web Application Vulnerabilities

If a web application is audited manually, the security audit is limited to the knowledge of the penetration tester. On the other hand, a heuristic web application security scanner has a vast list of web application vulnerabilities and security checks that is backed by a whole team of security engineers and researchers that regularly update it to include new attack vectors, bypasses and security checks.

Identifying Low Hanging Fruit Vulnerabilities

Many security professionals claim that automated tools will only identify low hanging fruit and technical vulnerabilities. True, but history has showed us that the majority of successful web application attacks exploited a technical vulnerability such as an SQL Injection or Cross-site Scripting. Very rarely attackers exploited logical vulnerabilities.

This does not mean you should ignore logical vulnerabilities, but you should automate the repetitive and use the saved up time to identify logical vulnerabilities. If you try to do both manually you will not manage to keep up with the development of the web application and the myriad of new attack variants.

Identifying Logical Vulnerabilities

There are two types of web application vulnerabilities, logical and technical vulnerabilities. Technical vulnerabilities are vulnerabilities in the code which can be identified by automated tools, such as the popular SQL Injection and Cross-site Scripting vulnerabilities. Logical vulnerabilities are vulnerabilities in the logic of the web application and not the code, hence only a person who is familiar with the scope of the web application can identify such vulnerabilities.

What is a Logical Vulnerability?

An advertising agency launches a promotion that gives away $100 to anyone who buys $100 worth of adverts. Though even when users buy less than $100 worth of advertising, the web application still gives away the free $100. Even though this is not a vulnerability in the code of the web application this is still a vulnerability which attackers can abuse.

Scanning Many Web Applications and Keeping Them Secure

The problem of identifying vulnerabilities and security flaws in web applications can get really worse when you have tens or even hundreds of web applications. In such cases it is not viable nor practical to do manual penetration tests. How can you quickly identify all the vulnerable web applications in case of a vulnerability outbreak, such as heartbleed? A desktop based web application security scanner will not scale up and do the job. Instead you should look into an online web application security scanner, which is purposely built to scale up and has the necessary tools to allow teams to collaborate and ensure all vulnerabilities are remediated before they are exploited by malicious hackers.

Web Application Security Convenience

Nowadays businesses heavily depend on web applications. New functionality is frequently being added to web applications to keep up with the business requirements. Every change that is applied should be tested prior to being implemented on the live servers. If you have an easy to use web application security scanner your own employees can scan the new web application changes and remediate any vulnerabilities the scanner reports prior to it being used in a live environment, without slowing down the deployment process.

You Need Automated Web Security Tools to Complete the Job

The benefits of automated tools can be many when it comes to web application security. Apart from saving time and ensuring accurate penetration tests, you can also save on budget too. If you use an easy to use and false positive free web application security scanner your own QA and testing teams can do the vulnerability scans, even if they are not web security experts. Since the scanner’s results are accurate they do not have to verify its findings so no training is required.

Emulate Malicious Hackers – Hack Your Website

Malicious hackers do not have access to the web applications’ code therefore they use automated black box scanners to scan websites in the hope of identifying vulnerabilities. Unfortunately most of the time they do identify vulnerabilities. As a matter of fact many internet security and monitoring organizations claim that at least a website is hacked every five seconds.

Therefore by emulating malicious hackers and using a web application security scanner to identify web application vulnerabilities in your websites and web applications is the best way to go about it. There is definitely no better way to secure your web applications.

Web Application Security Done Right

To recap it all, It is humanly impossible and unsustainable to manually audit a modern web application and check if it is vulnerable for every type of known and unknown vulnerability without making a mistake or within a respectable time frame. At the same time it is impossible for an automated tool to find all vulnerabilities. A perfect example is the OWASP Top 10 list. As explained in An Automated Scanner That Finds All OWASP Top 10 Security Flaws you have to do both automated scans and manual audits to identify all the vulnerabilities listed in the OWASP Top 10. Therefore even if you are thinking of hiring a penetration tester rather than doing the job yourself, If they do not use automated web security tools I recommend you to look somewhere else.

In web application security automated tools should not and will not replace the human factor, but the human alone cannot do a good job without using automated web security tools.

The post The Best Form of Web Application Security Scans appeared first on SecurityProNews.

Read more here:: Security Pro News

Cisco announced that it intends to acquire Neohapsis, a company which offers network, cloud, and app security, as well as IT risk and compliance services.

Cisco says it will use the acquisition to help customers build security capabilities and overcome operational and technical vulnerabilities, as well as “achieve a comprehensive view of their risks, take advantage of new business models, and define structured approaches for better protection.”

Neohapsis President and CEO James Mobley had this to say:

As our clients and friends in the industry know, Neohapsis has been a key player in the security, risk and compliance market. Today, we are excited to announce plans to join Cisco, who we believe will be the perfect strategic match for us, given our services and research mission.

We share with Cisco a global enterprise customer base, and a commitment to help our customers address their most challenging threats, especially in the rapidly evolving mobile and cloud arenas. Because of Neohapsis’ and Cisco’s shared focus on the Internet of Everything, the opportunity to do groundbreaking work together is enormous. Together, what we bring to enterprise customers, IoT device manufacturers, and associated service providers will be unique in the market.

“Today, businesses are looking at security in a strategic, comprehensive way to protect mission critical processes and assets,” said Hilton Romanski, who leads corporate development at Cisco. “There has never been a greater need to understand the impact that security threats can have on a company’s bottom line. For these reasons, experienced security advice is now among the table stakes required to assess and address the threat landscape that faces enterprises today. The skills and capabilities companies need to maintain a strong security posture, keep pace with rapidly evolving threats and take full advantage of new technologies that can protect their businesses are rare and difficult to retain. The right advisory service can change all of that.”

The Chicago-based Neohapsis team will join Cisco’s Security Services organization led by SVP and GM Bryan Palma. Cisco expects the deal to close in the second quarter of fiscal year 2015. Terms weren’t disclosed.

The post Cisco Announces Intentions to Purchase Neophasis appeared first on SecurityProNews.

Read more here:: Security Pro News

It’s likely that every single day, you use a messaging app to communicate with friends and family. It’s also likely that the messaging app you’re using is unequipped to protect your privacy.

The Electronic Frontier Foundation (EFF) has just released a scorecard featuring 39 messaging apps ranging in popularity from the relatively small Silent Phone and CryptoCat to the ubiquitous iMessage and Facebook Messenger. The scorecard measures the security of each app using seven different criteria.

That includes the questions … Is your communication encrypted in transit? Is your communication encrypted with a key the provider doesn’t have access to? Can you independently verify your correspondent’s identity? Are past communications secure if your keys are stolen? Is the code open to independent review? Is the crypto design well-documented? and Has there been an independent security audit?

Spoiler alert – it’s not good. The messaging landscape is woefully insecure.

In fact, only six applications garnered a perfect score: ChatSecure, CryptoCat, Signal/Redphone, Silent Phone, Silent Text, and TextSecure.

Every other app failed in at least one of the aforementioned areas.

“The revelations from Edward Snowden confirm that governments are spying on our digital lives, devouring all communications that aren’t protected by encryption,” said EFF Technology Projects Director Peter Eckersley. “Many new tools claim to protect you, but don’t include critical features like end-to-end encryption or secure deletion. This scorecard gives you the facts you need to choose the right technology to send your message.”

Out of the most popular apps to be rated, Apple’s iMessage and FaceTime had the best security score (five out of seven).

Services like AIM, Blackberry Messenger, Secret, and Yahoo Messenger were only able to garner one check mark – for messages being encrypted in transit.

Popular apps like WhatsApp, Snapchat, Skype, and Facebook Messenger only grabbed two checks.

“We’re focused on improving the tools that everyday users need to communicate with friends, family members, and colleagues,” said EFF Staff Attorney Nate Cardozo. “We hope the Secure Messaging Scorecard will start a race-to-the-top, spurring innovation in stronger and more usable cryptography.”

Eckersley told Ars Technica that even a perfect score on the EFF’s security scorecard did mean the apps are 100 percent recommended.

“Getting a perfect score here is more the first step than final victory. We still need usability studies, metadata protection, independently commissioned audits, and other measures of security before we try to get the whole network to switch to one of these options,” he said.

He went on to say that “good cryptographic design should not cause significant inconvenience.”

Check out the full report here.

The post Messaging Apps Are Terribly Insecure appeared first on SecurityProNews.

Read more here:: Security Pro News