Obscurity

Thursday September 25, 2008

Rational Appscan do what others cant...

Interesting product. IBM accquired it from Watchfire Corporation, a security and compliance testing software company based in Waltham, Massachusetts.  It appears that Appscan provides Web application security testing and compliance management software and services that help clients evaluate, understand and resolve issues impacting their online businesses. 

The product is very comprehensive in what it can provide:

    •  Established attacks and string based manipulation of URLs to detect vulnerabilities with regard to session hi-jacking, login avoidance, stray pages that don't have any security on them. This includes static AND dynamic testing.

    •  Port scanning for security holes like SQL injection

    •  A comprehensive report on all the exploits it found to work

    •  A recommendation on how to repair / patch these exploits.

Most products / suite of of products on the market do not have the reporting tool which has recommendations. I am usually skeptical of all-in-one products that claim to provide recommendations. Appscan seems to deliver what it promises.