Micro Focus

What is Application Security?

Application security is the discipline of processes, tools and practices aiming to protect applications from threats throughout the entire application lifecycle. Cyber criminals are organized, specialized, and motivated to find and exploit vulnerabilities in enterprise applications to steal data, intellectual property, and sensitive information. Application security can help organizations protect all kinds of applications (such as legacy, desktop, web, mobile, micro services) used by internal and external stakeholders including customers, business partners and employees.

Why Application Security?

As validated by multiple studies, the majority of successful breaches target exploitable vulnerabilities residing in the application layer, indicating the need for enterprise IT departments to be extra vigilant about application security. To further compound the problem, the number and complexity of applications is growing. Ten years ago, the software security challenge was about protecting desktop applications and static websites that were fairly innocuous and easy to scope and protect. Now, the software supply chain is much more complicated considering the outsourced development, the number of legacy applications, coupled with in-house development that takes advantage of 3rd party, open source and commercial, off-the-shelf software components.

Organizations need application security solutions that cover all of their applications, from those used internally to popular external apps used on customers’ mobile phones. These solutions must cover the entire development stage and offer testing after an application is put into use to monitor for potential problems. Application security solutions must be capable of testing web applications for potential and exploitable vulnerabilities, have the ability to analyze code, help manage the security and development management processes by coordinating efforts and enabling collaboration between the various stakeholders. Solutions also must offer application security testing that is easy to use and deploy.

What is SAST and DAST?

What is SAST?

Static Application Security Testing (SAST) scans the application source files, accurately identifies the root cause and helps remediate the underlying security flaws.

Developer Benefits of Static Application Security Testing:

  • Identify and eliminate vulnerabilities in source, binary, or byte code
  • Review static analysis scan results in real-time with access to recommendations, line-of-code navigation to find vulnerabilities faster and collaborative auditing.
  • Fully integrated with the Integrated Developer Environment (IDE)

What is DAST?

Dynamic Application Security Testing (DAST) simulates controlled attacks on a running web application or service to identify exploitable vulnerabilities in a running environment.

Benefits of Dynamic Application Security Testing:

  • Provides a comprehensive view of application security by focusing on what’s exploitable and covering all components (server, custom code, open source, services)
  • Can be integrated into Dev, QA and Production to offer a continuous holistic view
  • Dynamic analysis enables a broader approach to manage portfolio risk (1000s of applications) and may scan legacy apps as part of risk management
  • Tests functional app, so unlike SAST, is not language constrained and runtime and environment-related issues can be discovered

On-Premise vs SaaS Solutions

Application security solutions consist of the cybersecurity software (the tools) and the practices that run the process to secure applications.

On-Premise

Application security testing solutions can be run on-premise (in-house), operated and maintained by in-house teams. This approach requires organizations to provide the infrastructure, the personnel and acquire application security solutions for their usage. On-premise assures organizations that their application data is not shared with third parties and does not leave the premises.

SaaS

Application security can also be a SaaS (or application security as a service) offering where the customer consumes services provided as a turnkey solution by the application security provider. This approach doesn’t require any of the prerequisites of the on-premise approach but it does require relying partially or completely on the SaaS vendor and in most cases, allow the application data to be shared with the vendor. SaaS provides an easy way to get started on application security and can offer scalability and speed. Hybrid implementations (using on-premise and SaaS together in different projects and practices) aim to provide the best of both worlds by providing flexibility, scalability and cost optimization.

Speed vs Accuracy

Today, every business is a software business. As a result, there has been tremendous growth in the number of web and mobile applications and increasing frequency of application releases. In order to keep up with the business demands, many organizations perform lighter weight security scans, which sacrifice the accuracy needed to detect crucial vulnerabilities. Agility in security is a balance between performing thorough, accurate scans and the associated false positives that can paralyze remediation.

What is the OWASP Top 10

OWASP Top 10

The Open Web Application Security Project (OWASP) is an open source application security community with the goal to improve the security of software. Its industry standard OWASP Top 10 guidelines provide a list of the most critical application security risks to help developers better secure the applications they design and deploy. Find overviews and practical tips for each of the Top 10 in A Developer’s Guide to the OWASP Top 10.

Application Security Solutions

Micro Focus Application Security solutions offer application security testing and management on-premise and as-a-service that can help companies secure their software applications including legacy, mobile, third-party, and open-source applications.

The Micro Focus Fortify offerings included static, dynamic, interactive application security testing, and runtime application self-protection, as well as services to support a Software Security Assurance program, which are processes to ensure that the applications that run your business are protected and secure.

The solutions include:

Fortify Static Code Analyzer - Static Application Security Testing (SAST) - Identifies and pinpoints security vulnerabilities in source code early in the software development lifecycle.

Fortify WebInspect - Dynamic application security testing (DAST) – Simulates real-world security attacks on a running application to provide comprehensive analysis of complex web applications and services.

Interactive application security testing (IAST) – Integration of our dynamic testing and runtime analysis to identify more vulnerabilities by expanding coverage of the attack surface and exposing exploits better than dynamic testing alone.

Fortify Application Defender - Runtime application self-protection (RASP) – Actively monitors and protects applications in production that have known and unknown vulnerabilities.

Fortify on Demand – Security as a Service - A simple, easy and quick way to accurately test applications without having to install or manage software, or add additional resources.

Mobile Security – Mobile testing methodology that tests all three tiers including the client, network and server.

Software Security Assurance – Centralized management repository provides visibility that helps resolve security vulnerabilities.

Fortify Software Security Center - Centralized management repository providing visibility to the entire application security testing program. It prioritizes, manages and track security testing activities and provides an accurate picture of software security risk across your enterprise.

Contact us

Application Security Resources

Whitepaper - The 2019 TechBeacon Buyer's Guide to Application Security

Whitepaper - Seamless Application Security: Security at the Speed of DevOps

Video – Getting Started with Application Security in One Day

Webinar - Shift Left: 3 Steps to Get Your Developers Involved in Security

Whitepaper – Application Security Risk Report

Webinar - Fitting Security Into Your Software Lifecycle: Automation and Integration

Whitepaper – The State of Application Security in the Enterprise

OWASP Top 10 Most Critical Web Application Security Risks

Micro Focus Fortify Resources

Fortify Marketplace

Fortify Unplugged YouTube Channel

Fortify on Demand Free Trial

Fortify Community

Fortify Software Security Assurance Self-Assessment

Fortify Integration Ecosystem

Our Solutions

SAST: Fortify Static Code Analyzer

Automated static code analysis to help developers eliminate vulnerabilities and build secure software.

Learn more
DAST: Fortify WebInspect

Automated dynamic security testing tool to find and prioritize exploitable web vulnerabilities.

Learn more
Fortify on Demand

Trust the security of your software with our expertise, get started easily and scale as you grow.

Learn more
Fortify Software Security Center

Manage software risk across the entire secure SDLC - from development to QA and through production.

Learn more
RASP: Fortify Application Defender

Protect production applications from the inside with runtime application self-protection.

Learn more

Additional Resources

Blog: Building it in – Embedding application security into your software operations
Blog: Where mobile application security fits into the user experience
SANS Information Security Resources
Computer weekly IT Security resources
Dark reading security resources

Related Products, Solutions, and Services

Application security testing: Fortify
SAST: Fortify Static Code Analyzer (SCA)
DAST: Fortify WebInspect
Application security as a service: Fortify on Demand (FoD)
Centralized dashboard: Fortify Software Security Center (SSC)
RASP: Fortify Application Defender

Community

AppSec security blog
Security research blog
Micro Focus security on Twitter
Micro Focus security on LinkedIn
Fortify community
Product support and documentation
Fortify marketplace
Fortify unplugged
release-rel-2020-5-2-4497 | Thu May 28 12:30:11 PDT 2020
4497
release/rel-2020-5-2-4497
Thu May 28 12:30:11 PDT 2020