download issue 24 here - Help Net Security

The single tool trap
Scanning tools are an essential part of every
AppSec strategy, and so is choosing the right
one. Fortunately, ASVS provides enough
guidance on what vulnerabilities a tool should
be able to look for.
No one tool can do everything well. According
to an evaluation on application security scanning
tools, carried out by the US NSA Center
for Assured Software, the best coverage one
can get with a single tool is detection of
60.3% of the vulnerabilities of an application.
Other studies show similar or lower rates.
While tools are very useful and necessary for
attaining good efficiency levels in application
security testing, trying to create a strategy
around one particular tool may be a mistake.
The application security testing strategy
should leverage the right tools, at the right
place and time.
Verification requirements in the application
security policy
This OWASP ASVS standard provides
enough information to help define a basic set
of verification requirements that include coverage,
rigor and testing methods. With that in
place, it is time to map it to the recentlycreated
Application Criticality Matrix. For
example:
Note: This is an over-simplified table intended to exemplify the mapping activity.
Take into account that the requirements set
should not be limited to new and existing developments;
organizations should also consider
major and minor improvements, acquisitions,
and outsourced developments. All the
applicable cases, and the periodicity for the
requirements to be re-verified, should also be
taken into consideration.
Summary
An Application Vulnerability Detection Strategy
should be composed by three elements:
Application Criticality Matrix, suitable testing
approaches and verification requirement set.
Once the detection strategy has been created,
it is time to sell it to top management
using the results of applying risk rating criteria.
Add it to any existing application or information
security policies, and communicate the
changes to the company. It is not until this
point that the “dirty” work of testing the applications
should start.
There is much more to be done for an application
security program to become a real and
full-blown solution for any company; however,
these guidelines can serve as a starting point.
Once a detection strategy has been laid out,
teams should start to gather valuable information
on vulnerabilities, and then it may be a
good time to consider implementing a metrics
program.
Juan Carlos Calderon is the Information Security Research Leader for Softtek (www.softtek.com) and is
CSSLP certified. With nine years of experience working in the application security arena for international companies,
his responsibilities include (among others) penetration testing and security code reviews for hundreds
of applications in the Financial, Energy, Media, Aviation and Healthcare industries. He is an active participant
at renowned OWASP project.
www.insecuremag.com 31