Tag Info

New answers tagged


Depending on language and environment: US DHS and a third party host SWAMP (software assurance marketplace). You must apply for access and membership, but it's worth looking into. SWAMP


There are IT security companies which provide services like code auditing (most often along with other services like penetration testing, etc.). You contact them, describing your needs, then if this fall under their competences they will send you an estimate.


Personally, I do use adversary tools and techniques to test my target systems, networks, and apps. For the web layer, as an example, tools like Acunetix WVS have historically been warezed by online criminals. Metasploit is a bad example for this scenario proposed by the questioner (and as alluded to in some of the comments). A better example would be to use ...


Software bugs are discovered primarily through source code auditing, reverse engineering, and fuzzing. Fuzzer is the tool which can be termed as "the hacker tool" which you mentioned. Google spend thousands of hours fuzzing chrome and other critical software before release. Adobe is following these practices as well after the horrible abuse of ...


In addition to ack_'s answer, there is a significant learning curve to using these tools. As a penetration tester myself the time spent weeding out false positives and non-exploitable vulnerabilities often takes just as much (if not more) time as trying to leverage an attack. Add to that the time it takes to become proficient at using these tools and you ...


They (should) do, specially companies that have to conform to some security standards like payment card industry: PCI-DSS or iso 27001. They have to have a secure SDLC incorporating secure coding training, code review by security expert (white box testing), and periodic penetration testing (black box testing) performed by external companies as well. Also the ...


They are doing it, or at least they're expected to do so, as part of their Software Development Life Cycle (SDLC). In terms of vulnerability management, a best practice would be to first perform a source-code review (static/dynamic), and to scan their product using a vulnerability scanner. Note that there are also other steps to enforce a secure SDLC, such ...

Top 50 recent answers are included