Scalable application assessments in the enterprise

greggles — Fri, 13 Nov 2009 15:51:18 +0000

Tom Parker & Lars Ewe of Cenzic discussed automated and manual testing and how to scale those practices to large enterprises.

One big question they posed was "How often are you scanning your applications?" And the basic point is, we don't run virus scanners one time we run them regularly and the same should apply to application scanners.

They contend that there are two major schools about scanning

Automated testing is the only practical and financially scalable solution.
Manual testing is the only valid solution.

We just had a session about why automatic testing isn't enough Application security beyond the scanner monkey - but at least automated testing can make manual testers more efficient.

Why manual assessments don't scale

It's hard to find good people
People are inconsistent
So, fully manual testing tends to be expensive (about $140k/year) and how many applications can this person review per year at that rate?

History of scanners

People had manual testing and built tools to make it easier - like proxies.
Some special purpose suites emerged like sql injection helpers.
More and more automated tools were developed.
Automated tools that covered a broad set of features are now available, but may provide too many false positives while also giving a false sense of security - they are very difficult to run properly.

So, as has been said before, scanners are just a part of a full solution but they can be a very important part for reducing costs and making people more effective.

Cracking Drupal - third way

Scalable application assessments in the enterprise

Why manual assessments don't scale

History of scanners