UncategorizedGetting to Faster Vulnerability Remediation During DevSecOps | Enhance DAST Results

Blog

August 20, 2020 Timothy Chiu, VP of Marketing
Getting to Faster Vulnerability Remediation During DevSecOps

We recently wrote about how the amount of vulnerabilities found in code continues to increase at an unprecedented rate.  Part of the reason why so many vulnerabilities make it to production is the increased pressure to release code quickly.  There’s been added pressure during the COVID-19 pandemic, with a need for new applications to fulfill the work from home needs of the quarantined public. This need to release code quickly produces a need to remediate found vulnerabilities quicker.  This need exists as part of DevOps and DevSecOps during application testing, as well as for found vulnerabilities in production code (and maybe this need is even greater in new vulnerabilities found in production code).

It’s likely your organization is already attempting to find as many vulnerabilities as possible in your applications before you deploy them to production.  A typical enterprise will run applications through DAST (Dynamic Application Security Testing) and Penetration testing before allowing the application to make its way out to a production deployment.  A typical DAST or penetration testing tool will run simulated attacks using attacks on well known and common vulnerabilities found in application code, similar to the way a hacker will to find and exploit a vulnerability.

The typical DAST and penetration testing tools today will find vulnerabilities and produce reports about the vulnerabilities that exist in your applications.  But that tends to be where these tools stop.  They do little to help developers find these vulnerabilities in the actual code, meaning developers have to spend extended time looking at code to try and find the source of the vulnerabilities.

So the question then arises, how can you improve the visibility provided by your testing tools, to help you remediate vulnerabilities more quickly?

K2 Cyber Security can help address the issues around the lack of remediation guidance and the poor quality of security testing results.  K2 Cyber Security Platform is a great addition for adding visibility into the threats discovered by penetration and security testing tools and can also find additional vulnerabilities during testing that testing tools may have missed.  K2 can pinpoint the exact location of the discovered vulnerability in the code.  When a vulnerability is discovered (for example, SQL Injection, XSS or Remote Code Injection), K2 can disclose the exact file name along with the line of code that contains the vulnerability, details that testing tools typically are unable to provide, enabling developers to start the remediation process quickly.

In addition, because the K2 agent resides on the application server, when a DAST or penetration testing attack is run, K2 has visibility into the application, understands the application execution, and intention of the code, so that K2 can detect and report on additional vulnerabilities that the DAST and penetration testing tools will miss by not having application server visibility.  In testing with some of the leading testing tools, and well-known vulnerable applications, K2 detected significant additional vulnerabilities that the testing tools missed.

K2 Cyber Security Platform offers two use cases, the first as described here is additional visibility during pre-production (development) penetration testing, while the other is runtime protection for applications in production.  In the second use case,  K2 offers an ideal runtime protection security solution that detects true zero-day attacks, while at the same time generates the least false positives and alerts.  Rather than rely on technologies like signatures, heuristics, fuzzy logic, machine learning or AI, we use a deterministic approach to detect true zero-day attacks, without being limited to detecting attacks based on prior attack knowledge.  Deterministic security uses application execution validation, and verifies the API calls are functioning the way the code intended.  There is no use of any prior knowledge about an attack or the underlying vulnerability, which gives our approach the true ability to detect new zero-day attacks. Our technology has 8 patents granted/pending, and has minimal false alerts.

Get more out of your application security testing and change how you protect your applications, and check out K2’s application workload security solution.

Find out more about K2 today by requesting a demo, or get your free trial.


 

 

Share this

Leave a Reply

Your email address will not be published. Required fields are marked *

K2 CYBER SECURITY

K2 Cyber Security delivers the Next Generation Application Workload Protection Platform to secure web applications and container workloads against sophisticated attacks including OWASP Top 10 and memory-based attacks, and provides additional vulnerability detection. K2’s Platform is deployed on production servers for runtime protection of applications and on pen-testing/pre-production servers to identify the location of the vulnerable code in real-time. K2’s solution generates almost no false alerts, eliminates breaches due to zero-day attacks, detects attacks missed by traditional security tools including Web Application Firewalls, and dramatically reduces security cost. K2 Cyber Security is located in the USA, and provides cyber security solutions globally.

CONTACT INFO

K2 Cyber Security, Inc.

2580 N. First Street, #130

San Jose, CA 95131