The good thing with SonarQube is it covers a lot of issues, it's a very robust framework.
Apart from the security point of view, I like that it makes it easy to detect code smells and other issues in terms of code quality and standards.
The identification of verification-related security vulnerabilities is really important and one of the key things. It also identifies vulnerabilities for any kind of third-party tool coming into the system or any third-party tools that you are using, which is very useful for avoiding random hacking.
When I started to install the Nexus products and started to integrate them into our development cycle, it helped us construct or fill out our development process in general. The build stage is a really good template for us and it helped establish a structure that we could build our whole continuous integration and development process around. Now our git repos are tagged for different build stages data, staging, and for release. That aligns with the Nexus Lifecycle build stages.
It is easy for developers to use. The documentation is clear as well as the APIs are good and easily readable. It's a good solution overall.
From the software composition analysis perspective, it first makes sure that we understand what is happening from a third-party perspective for the particular product that we use. This is very difficult when you are building software and incorporating dependencies from other libraries, because those dependencies have dependencies and that chain of dependencies can go pretty deep. There could be a vulnerability in something that is seven layers deep, and it would be very difficult to understand that is even affecting us. Therefore, Snyk provides fantastic visibility to know, "Yes, we have a problem. Here is where it ultimately comes from." It may not be with what we're incorporating, but something much deeper than that.
I find the attack model quite amazing, where I can write my scripts and load my scripts as well, which helps quite a bit. All the active scanning that it can do is also quite a lot helpful. It speeds up our vulnerability assessment and penetration testing. Right now, I am enjoying its in-browser, which also helps quite a bit. I'm always confused about setting up some proxy, but it really is the big solution we all want.
One of the top features is the source code review for vulnerabilities. When we look at source code, it's hard to see where areas may be weak in terms of security, and Fortify on Demand's source code review helps with that.
Acunetix has an awesome crawler. It gives a referral site map of near targets and also goes really deep to find all the inputs without issues. This was valuable because it helped me find some files or directories, like web admin panels without authentication, which were hidden.
Advice From The CommunityRead answers to top Application Security questions. 456,966 professionals have gotten help from our community of experts.
See more Application Security questions »
Rony_SklarCommunity Manager at IT Central Station
There are many cybersecurity tools available, but some aren't doing the job that they should be doing. What are some of the threats that may be associated with using 'fake' cybersecurity tools? What can people do to ensure that they're using a tool that actually does what it says it does?
Menachem D PritzkerDirector of Growth at IT Central Station
On July 15, 2020, several verified Twitter accounts with millions of followers were compromised in a cyberattack. Many of the hacked accounts we protected using two-factor authentication, which the hackers were somehow able to bypass. Hacked accounts included Barack Obama, Joe Biden, Bill Gates, Jeff Bezos, Mike Bloomberg, Warren Buffett, Kim Kardashian, and Kanye West, Benjamin Netanyahu, and several high profile tech companies, including Apple and Uber. The hackers posted variation of a message asking follower to transfer thousands of dollars in Bitcoin, with the promise that double the donated amount would be returned. How could Twitter have been better prepared for this? How do you rate their response?
I am researching application security software for my organization. We provide systems to the airline industry. Which products provide both vulnerability scanning and quality checks? Which one(s) do you recommend and why? Thanks, CK
What is Application Security?
The members of IT Central Station were clear on what was most important when evaluating Application Security: while some also mentioned that the software should be silent and have the ability to lock down configuration settings, everyone agreed that quality Application Security should provide intelligent data and come with a solid reputation, a strong usage pattern, efficient data handling, and a clean design. Members also mentioned documentation and maintenance as benefits.