Use of automated security testing tools in the industry

Question

I read this article about the 10 year old Finnish boy collecting a $10,000 bug bounty from Instagram with interest. According to the article (and I hope someone can shed more light on the exact details of the bug bounty), this boy was able to pick up information from Youtube and other online resources to figure out the security loophole.

What I am wondering about is whether there are standardized tools or plug-ins that programmers use to conduct automated security audit of their code, and if there are standardized tools that penetration testers use to do an automated security testing of the site. And if there are, then what is the likelihood of events such as the one described in the article occurring and what can the companies do to minimize the risk of these events?

Answer 1

There are many tools, and a few standards, but no standardized tools and a lot of the tools are expensive.

To minimize risk you basically have to teach your team how to code and deploy securely, conduct security tests frequently, and frequently update your security infrastructure at a very fast cyclical pace.

This can get expensive to do (time or money-wise) so lots of people simply don't do it or they only do a little bit.

The constant "rush to market" isn't helping matters. The current business trend is on speed to deliver an incomplete product rather than building for long-term quality. So inevitably cuts are made and some of the cuts are in security. This is unfortunate because in most cases the cost to re-engineer a product so it has security is MUCH more than it would have been to design security into it from the beginning.

Answer 2

Owasp is one of the most respected authorities on information security. Here is their list of testing tools. https://www.owasp.org/index.php/Appendix_A:_Testing_Tools

In regard to minimising the risk:

1. Organisations should ensure their solution architecture takes into account the importance of information security.

2. organisations should commission regular penetration tests by external companies who specialise in information security and fix any vulnerabilities that are detected.

3. Organisations should keep their software and network infrastructure as current as possible.

4. Organisations should have dedicated information security experts who keep on top of the emergence of new threats and apply patches in a timely manner.