Full width home advertisement

Post Page Advertisement [Top]

I created a post about security tools (primarily red team focused) yesterday (
https://www.reddit.com/r/cybersecurity/comments/1esy1yk/comment/lifqh06/?context=3) and people seemed to enjoy it, so I created an AppSec list :).

If you have any other suggestions, please comment them so I can add in.

* Static Application Security Testing (SAST) Tools




Quickly identify security vulnerabilities in the code and fix them during development.

* SonarQube
* Veracode
* Snyk SAST (
https://snyk.io/product/snyk-code/ /> * GitHub Code Scanning)




* Dynamic Application Security Testing (DAST)




Analyze security vulnerabilities in real-time in production environments. DAST tools also enable developers to simulate cyberattacks and detect runtime errors.

* Intruder
* HCL AppScan
* Veracode




💡 I**nteractive Application Security Testing (IAST) is a combo of SAST and DAST. You can analyze the code during any stage of development and *in real-time in the production applications.

A popular tool in this space is Checkmarx



* Run-time Application Security Protection (RASP)




Run continuous security testing and automate the incident response during security breaches.

* Dynatrace
* Datadog Application Security Management




* Webapp Pentesting (also under Red Team/Pentesting)




AppSec should also understand penetration testing. Here are some tools that can help for Web App pentesting

* ZAP (
https://www.zaproxy.org/) /> * OpenSCAP (web app scanner along with vulnerability assessments and compliance)
https://www.open-scap.org/ /> * Burp Suite (Community and Paid)




💡 Lots of other pentesting tools (Nmap, Nessus, etc.) fall under the “webapp pentesting” category.



* Container Security




Containers are currently the smallest form factor to run an application. You decouple your application stack (sometimes called microservices) into multiple pieces so they can be managed and deployed separately.

* Snyc Containers (
https://snyk.io/product/container-vulnerability-management/) /> * Docker Scout




* Kubernetes Security




Kubernetes is an orchestration system (originally for just containers) that allows you to scale application stacks.

* Kubescape
* Aqua Security





* Vendors/Tools that “do it all”

* Snyk (
https://snyk.io/)/(https://snyk.io/solutions/application-security/) />



submitted by /u/mikelevan
[link] [comments]


http://dlvr.it/TC2YQR

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)
'; (function() { var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true; dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js'; (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq); })();

Bottom Ad [Post Page]

Copyright 2017, " Vpentest ". All rights Reserved.
| Designed by Colorlib