A significant value proposition of Interactive Application Security Testing (IAST) is enablement of Shift-Left practices that allow Application Security Testing to be integrated into the SDLC in its early stages, reducing the number of security issues that are discovered in late stages of the development process. In this blog, we explore HCL AppScan’s IAST solution and learn how it integrates with the SDLC.

Is My Testing Complete?

For many years, basic Application Security protection consisted of the Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST)  approaches. Although the two testing techniques complemented each other, there was always a nagging question for testers: “Is my analysis really complete?”

As you may be aware, each testing methodology has its own limitations. DAST addresses testing on running applications and simulates a potential attacker’s point of view, whereas SAST tests only source code. Meanwhile, security analysts and developers strive to have comprehensive AST performed, with few or no false positive findings for them to wade through. How can that be achieved?

Enter HCL AppScan on Cloud IAST

HCL AppScan on Cloud (ASoC) IAST empowers your AST program, by producing a minimum number of false positives and helping your organization to expand its Shift-Left strategy. Instead of a scanner, AppScan IAST is a monitoring agent that’s instrumented within your application server. As its name suggests, IAST is interactive within the application and monitors everything from “Source” to “Sink” whilst you interact with the application, even during QA/DAST processes.

Since IAST is instrumented in the application server, it can see through all of the transaction database calls, data flows, file system access activities, etc. IAST alerts you if it finds any vulnerabilities, with clear trace calls and requests. This in turn will empower you and your developers to identify and fix security issues straightaway.

Furthermore, HCL ASoC IAST offers a no-click installation process. You just need to place IAST in your application server, and it is ready to monitor your applications and alert your testers about potential vulnerabilities.

To Learn More

As with any tool, IAST has its advantages and its limitations. To learn more about IAST and its many more features, you can download my recent white paper. You will also find a working example of how you can identify and remediate a Cross-Site Scripting (XSS) vulnerability in our white paper.

And, to test-drive HCL AppScan on Cloud for yourself, click here.

 

 

 

 

 

 

 

Comment wrap
Further Reading
Secure DevOps | November 20, 2020
HCL AppScan on Cloud est arrivé en Europe!
Our new HCL AppScan on Cloud capabilities in Europe permit you to conduct Application Security Testing while leveraging European data residency.
Secure DevOps | November 10, 2020
HCL AppScan: Now Supporting SAP ABAP
Read this blog to learn more about HCL AppScan's support of SAP ABAP. And, you can request a free trial or demo of our AppSec solution.
Secure DevOps | November 2, 2020
AppScan and the OWASP Top 10: A Focus on SQL Injection
As part of our periodic blog series that's focused on OWASP Top 10 vulnerabilities, this article examines the most prevalent vulnerability: SQL Injection.
a/icon/common/search Created with Sketch.