Application Security Testing

The primary challenges for AppSec today is the vast pressure exerted on developement teams to deliver innovation. Agile principles and now DevOps are both initially focussed on time to market rather than improved quality. DevSecOps principles are touted to address these issues from a security point of view but very often developers don’t have the skills or focus to attend to effectively implement processes and tooling, or sift through reams of security data.

As with every other aspect of the DevOps pipeline, more automation is required in picking up, analysing and interpreting vulnerabilities. As with all testing disciplines, security testing should apply a shift left approach with Static Application Security Testing (SAST) or whitebox testing against source code taking place in development augmented by testing from the frontend in QA, also called Dynamic by Static Application Security Testing (SAST) as well as Out-Of-Band Application Security Testing (OAST). The reason for requiring multiple ways to test is that, due to the inherent method of testing for each of these approaches, no one of the abovementioned approaches is likely to pick up all vulnerabilities.

Micro Focus provides a comprehensive suite of AppSec tooling that incorporates Static Application Security Testing, Dynamic Application Security Testing as well as Out-Of-Band Application Security Testing which creates a layered defense where one method safeguards against misses in a prior layer. This approach also provides a unified taxonomy across testing methods that enables a complete view
of vulnerabilities.

The knock on effect of this unified taxonomy across SAST, DAST and OAST, developers are presented with results that share recommendation advice and security mappings, enabling collaboration and remediation. Additionally, this overlay of vulnerabilities from multiple testing methods creates a complete real-world risk picture that aids with prioritization which also reduces the noise. Last, but not least, the Micro Focus unified vulnerability management platform also creates a consistent feedback loop creating awareness and increasing collaboration.