Tag Info

New answers tagged

0

How effective are IAST tools at finding vulnerabilities? HP WIRT, Acunetix with Acusensor, Contrast Security, Quotium, and Appscan Enterprise can find more vulnerabilities when they are in the best-fit scenario. Yes, I have used Contrast Security and WIRT to find vulnerabilities faster than without the SAST-side capabilities (note that WIRT gives ...


0

I'm working for the company who wrote the case study Quotium (http://www.quotium.com) but I will try to be objective in my answer ! The point is not to find vulnerabilities but to be able to have developers fix quickly the ones which pose a real risk to your business and specifically your data (main scope of hackers). Why ? When you are developing in an ...


0

Which is better? a hammer or a screwdriver? It all depends on the problem. Given that you do not know the weaknesses beforehand, the approach recommended by IARPA' STONESOUP is to use multiple tools with multiple approaches. NIST's Paul Black highlights the advantages and disadvantages of static analysis in his CrossTalk March/April 2009 article. "New ...


0

Each method (DAST vs SAST) has its strengths and weaknesses. For example, DAST method is much better positioned at evaluating XSS type vulnerabilities because it is actually able to execute "on the client side" to validate if execution is indeed possible (rather than benign reflection). SAST in this case for the most part is limited to proving that input ...



Top 50 recent answers are included