Better Software - June 2008 - (Page 43)

Automated application security testing software will spider the entire application by clicking every button and link, filling out data fields to identify the structure of the program, and then auditing each page for vulnerabilities. It should do this from the outside in, reviewing each portion of the site the way an external hacker might. This comprehensive approach is valuable to ensure that all security holes have been identified and can be fixed. On the down side, it can also produce false positives, and it may not be able to access all of your web pages due to the way that certain pages are coded. Manual testing allows a user to focus on specific pathways or tasks on a website while the software follows silently behind, tracking the process. The program can then audit the particular path that the user has taken for security vulnerabilities and provide a report. Manually crawling an application can be time consuming, but it also ensures that specific pages are tracked and analyzed. • How well does the product integrate with leading quality management platforms? • Does the product appear to evaluate each page of your application or does it get stuck on certain pages? • Does the product allow the end user to easily modify scan settings? • What kinds of restrictions are in the product’s license? • In which formats are reports offered (PDF, HTML, XML)? Are they easy to read? Do they contain information on the location of the vulnerability, how to execute it, how to verify it and how to fix it? • Will the company allow you to evaluate the product before committing to purchase it? Confident vendors will often provide a seven- to 15-day evaluation period. Choosing the right products The following basic questions should be addressed when you are looking for a web application security testing product: • How easy is the product to use? • What kind of training will your QA department require in order to properly use the product? • How well does the product integrate into the tools and software that are already used by your organization? • How often is the product updated with new security checks—daily, weekly, monthly? • What is the false positive rate of the product? While no product is perfect, you want to find a product with as a low a rate as possible so that your resources are not wasted going through false positives. HP Software makes it easy Leading the charge in application quality and security, HP Software has recently completed the acquisition of SPI Dynamics, the leader in web application security testing. SPI Dynamics technology, which is already seamlessly integrated with HP Quality Center software, enables organizations to assess security vulnerabilities along the entire lifecycle of web applications—including development, QA and operations. Customers can also use SPI Dynamics software to validate application security and quality to meet auditing and compliance requirements, such as SOX. To find out more about HP Software’s integrated solutions for Application Quality and Security, please visit www.hp.com/go/software © 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Special Advertising Section http://www.hp.com/go/software http://www.hp.com/go/software

Table of Contents Feed for the Digital Edition of Better Software - June 2008

Better Software - June 2008 Contents Mark Your Calendar Contributors Technically Speaking eLightenment Code Craft Test Connection Management Chronicles Agile Model-Driven Development The Myth of Risk Management Stop the Insanity! Product Announcements 10 Things You Might Not Know About … The Last Word Ad Index

Better Software - June 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.