In a recent Technical Review of HCL AppScan, analyst firm Enterprise Strategy Group (ESG) evaluated and analyzed how AppScan helps developers to continuously secure applications. ESG also evaluated how AppScan can easily be integrated into CI/CD pipelines and support DevSecOps initiatives, to provide organizations with continuous application security at scale.  

ESG’s Methodology 

To thoroughly evaluate AppScan’s application security testing capabilities, ESG followed the general steps that are outlined below: 

  1. ESG defined and associated security policies with an applicationusing HCL AppScan on Cloud’s user interface.  
  2. Then, ESG associated security policies with the application.  
  3. Next, ESG evaluated AppScan’s scan and analyze capabilities, by integrating AppScan into a DevSecOps toolchain 
  4. After evaluating AppScan’s “scan and analyze” capabilities, ESG created a manual dynamic scan and reviewed scan results using the AppScan console.  
  5. Finally, ESG evaluated AppScan’s reporting capabilities 

AppScan’s Impact on DevSecOps  

ESG found that AppScan integrated into four main aspects of DevSecOps: 

  • Policy definition, where security and regulatory professionals define and associate policies with an application.  
  • Scan and analyze, when developers use static analysis to “shift security left,” so that they can identify vulnerabilities in code early in their CI/CD pipelines. Dynamic and interactive testing similarly help developers to identify vulnerabilities in running applications.  
  • Vulnerability Remediation, the process that permits developers to review and fix vulnerabilities. ESG found that AppScan’s machine learning accelerated remediation by grouping and prioritizing related vulnerabilities and by identifying potential fixes and fix locations in source code.  
  • Reporting, a key component of the DevSecOps process, where security and regulatory professionals and organizational management can continuously monitor their security and compliance progress.  

You can review all of ESG’s key findings- including benefits that you can achieve by incorporating AppScan into a DevSecOps model- by downloading the complimentary report now.  

Why Application Security Matters to You  

In the closing “Why This Matters” section of its report, ESG summarized the benefits of an effective Application Security Testing program, which I’ve captured verbatim below:  

Integrating and automating application security testing into the DevSecOps methodology enables the identification and correction of cybersecurity vulnerabilities earlier in the application development lifecycle, which enhances security and increases efficiency. It also helps to alleviate challenges faced by skilled cybersecurity teams, which are often much smaller than development teams, as they try to keep up with the increasing pace DevSecOps demands. 

ESG validated that HCL AppScan simplified and accelerated application security testing. With just a few clicks, ESG defined security policies and configured AppScan to test our application for a set of security vulnerabilities and compliance with benchmarks and regulations. ESG found configuring and running on-demand scans to be just as quick and easy, and results from static and dynamic analysis were presented quickly in a concise and consistent interface. 

To Learn More

In addition to downloading ESG’s complete reportyou can watch my companion video with ESG analyst Dave Gruber, where Dave and I spotlight the elements of a truly state-of-the-art Application Security Testing solution.  

Comment wrap
Further Reading
Secure DevOps | June 24, 2022
Automatic Issue Correlation Now Part of HCL AppScan
There is no silver bullet that can solve the application security challenge. Each of the core technologies (IAST, DAST, and SAST) has strengths and weaknesses.Auto Issue Correlation allows us to leverage the strengths of each technology, while overcoming weaknesses with the advantages of the others. Furthermore, Auto Issue Correlation enhances your AST capabilities, improves your prioritization process and reduces remediation time and effort.
Secure DevOps | June 6, 2022
Guide To Reliable Application Security Testing Software
Looking for a secure solution for fast, accurate, and agile application security testing? You can come across reliable market-leading web application security testing facilities that quickly detect system vulnerabilities. Read the blog to know more.
Secure DevOps | May 20, 2022
New Vulnerability in Spring Framework Detected
A new vulnerability, dubbed SpringShell in Spring Framework, was recently discovered by the HCL AppScan team.SpringShell was given a CVE ID of CVE-2022-22965, and results in Remote Code Execution (RCE) upon successful exploitation, compromising the web server and putting it under the attacker's control. It affects Spring Framework versions 5.3.17/5.2.19 and lower (it was patched in versions 5.3.18/5.2.20).
Filters result by