Best Practices When Implementing Web Application Scanning into an SDLC

May 30, 2017 Matt Wilgus

Web application scanning, a type of dynamic application security testing (DAST), is an important component for organizations looking to provide a secure online offering to their clients.

Unfortunately, the historical approach of “spider and scan” often does not meet expectations, leaving applications vulnerable. While this is sometimes due to scanning tools lagging or new technologies being deployed, it is more often the case that an organization’s approach has been done in haste, and the people, processes, and technologies in place are not properly configured.

This article will provide an overview on web application scanning, address some of the key areas to consider when implementing or updating a web application scanning program into a software development life cycle (SDLC), and how it can result in applications being more secure and compliance efforts requiring fewer resources.

Read the full article published in the May edition of the ISSA Journal >>

About the Author

Matt Wilgus is a Principal at Schellman, where he leads the Threat and Vulnerability Assessment offerings. In this role he heads the delivery of Schellman’s penetration testing services related to FedRAMP and PCI assessments, as well as other regulatory and compliance programs. Matt has over 20 years’ experience in information security, with a focus on identifying, exploiting and remediating vulnerabilities. In addition, he has vast experience enhancing client security programs while effectively meeting compliance requirements.
More Content by Matt Wilgus

Welcome to our Hub

Best Practices When Implementing Web Application Scanning into an SDLC

About the Author

Previous Flipbook

Next Article

Best Practices When Implementing Web Application Scanning into an SDLC

About the Author

Previous Flipbook

Next Article

Other content in this Stream

For any penetration testing engagement, internet-facing services are an important part, and there are multiple ways to obtain information before determining if they are vulnerable to exploitation.

What are the common reasons CSPs fail to achieve a FedRAMP Authority to Operate ATO in a timely manner?

Many organizations provide Application Program Interfaces (APIs) to allow their clients and business partners to enter and retrieve data. We primarily see REST based APIs, but also GraphQL and SOAP.

This has been the most rewarding and engaging work and continues to be my dream job, and yet, the transition from full-stack web application developer to penetration tester was daunting.

When it comes to cybersecurity, it’s the things we don’t know that can be the scariest.

Please, join Matt Wilgus and Josh Tomkiel from Schellman's Threat and Vulnerability Assessment team, as they cover the ins and outs of performing a penetration test of cloud based services.

EC-Council brings a new range of real world challenges that will not only test your Pen-testing skills but guarantees you an experience that is not built for the weak hearted.

The Why, How & Top Benefits

Employees are one of the weakest links in any business’ security defenses, especially if there is a lack of awareness about criminal attacks that are designed to obtain sensitive...

Many of the requests that we receive are limited in scope to Internet facing assets. A true understanding of the threats facing your networks requires a complete evaluation of all...

Originally published at blog.pcisecuritystandards.org In this post, we get insights from Jacob Ansari, Manager at Schellman & Company, LLC He will present“Hunting Paper Tigers: A...

The release of details contained in the Panama Papers will be one of the biggest news stories of the year. The number of high-profile individuals implicated will continue to grow as teams comb...

Overview In the last 30 days, the FedRAMP Program Management Office (PMO) has published guidance for both vulnerability scanning and penetration testing. The updated guidance comes on the heels...

A walk-through security and compliance implications for modern SDLC, with a heavy attention on DevOps.

If there’s one question in the new PCI DSS 3.0 that’s been generating a lot of conversations between clients and security professionals, it’s Requirement 11.3 which adds some rigor around...