Vulnerability scanning and penetration testing are essential components of application security testing. Such efforts require organizations to scan publicly and privately accessible websites, critical applications and endpoints using scanning tools to protect financial, personal identifiable, proprietary, and privileged information. The objective of such testing is to identify vulnerabilities such as encryption issues, misconfigurations, missing patches, and application vulnerabilities such as to SQL injection, cross-site scripting, OWASP Top 10 vulnerabilities, that may compromise private data.
These scanning engines work against a known list of common exploits such as those defined by OWASP and others. The exploits defined by OWASP (such as OWASP Top 10) use various techniques such as SQL injection, cross-site scripting (XSS), man-in-the-middle (MITM) attack, and malware injection to hack vulnerable web applications and websites in order to exfiltrate data, to trick users or systems into providing sensitive information, or to disrupt application performance.
The output of scanning tools provides a list of vulnerable URLs that may be then patched in development or imported into WAF and WAAP devices to protect against hacking attempts. Radware’s web application firewall (WAF) was the first to provide a real-time security patching solution for web applications in continuous application deployment environments via a tight integration with dynamic application security testing (DAST) solutions. The integration between DAST solutions and Radware’s WAF/WAAP enables automation and acceleration of web application virtual patching against known web application vulnerabilities.
Vulnerability scanning tools are expensive and proper testing requires security expertise. As part of its WAF, Radware includes scanning engine to automatically generate security policy for securing web applications. The Auto Policy Generation module is included in Radware’s and will automatically utilize the required security filter, create security filter rules , and switch the security filters into active mode. Organizations can use the built-in auto policy generation, support for vulnerability scanning engines and DAST tools, API discovery and negative and positive security models in Radware WAF to secure APIs and applications.
Application Vulnerability Analyzer Features And Comparison
| |
Radware |
CDN-based WAF |
Public Cloud Native WAF |
Software-based WAAP |
| Negative Security Model and Integration with Scanning Tools |
Yes |
Yes |
Yes |
Yes |
| Integration with DAST |
Yes |
No |
No |
Yes |
| Positive Security Model |
Yes |
No |
No |
Yes |
| Vulnerability Scanning and Auto Policy Generation |
Yes |
No |
No |
No |
| API Discovery |
Yes |
No |
No |
Maybe |
Additional Resources