Founder of AppSec Santa and Sales Director at Kondukto
Vendor
2023-01-19T16:39:33Z
Jan 19, 2023
Application Security Posture Management (ASPM) is a technology for security teams to manage security testing tools and vulnerability remediation processes.
A modern application security posture management platform should be able to integrate with all kinds of vulnerability scanning tools, issue managers, notification tools, and application lifecycle management tools.
Search for a product comparison in Application Security Tools
I'd like to add to the previous comment the SCA (software composition analysis) perspective.
Today each organization use open source components in multiple ways (at its infrastructure, 3rd party tools, as building blocks in its software development) there is no "Open Source LTD" company that will alert you for the new zero-days which becomes known published vulnerability of one of your open source components (e.g. log4j) - the responsibility is yours!!!
Part of Security Posture Management is to know about each and every open source component you are using, get timely alerts on new vulnerabilities and take the right assessment about it (require patch/customer notification/update/commit/not exploitable).
This should be part of a written open-source organization policy where roles and processes are clearly defined.
Global Head of Quality Engineering at IGT Solutions
User
2022-02-28T07:05:25Z
Feb 28, 2022
It is a platform to monitor, assess and control cyber security risks for an organizations.
It integrates and centralizes the findings and remediation of all security issues / information coming from various security tools in phases of SAST, DAST, IAST etc.
Key points are observability and remediation capabilities at one place. This is an evolving area and will take some time to fully mature.
Few tools companies are claiming to be providing solutions for ASPM such as
Global Head of Quality Engineering at IGT Solutions
User
Feb 28, 2022
@Evgeny Belenky It is a platform to monitor, assess and control cyber security risks for an organizations.
It integrates and centralizes the findings and remediation of all security issues/information coming from various security tools in phases of SAST, DAST, IAST, etc.
Key points are observability and remediation capabilities at one place. This is an evolving area and will take some time to fully mature.
Few tools companies are claiming to be providing solutions for ASPM such as Armorcode, but I am yet to assess its capabilities.
Application security is a significant challenge for software engineers, as well as for security and DevOps professionals. It comprises the measures taken to improve the security of online services and websites against malicious attacks by finding, repairing, and preventing security weaknesses and vulnerabilities.
Application Security Posture Management (ASPM) is a technology for security teams to manage security testing tools and vulnerability remediation processes.
A modern application security posture management platform should be able to integrate with all kinds of vulnerability scanning tools, issue managers, notification tools, and application lifecycle management tools.
I'd like to add to the previous comment the SCA (software composition analysis) perspective.
Today each organization use open source components in multiple ways (at its infrastructure, 3rd party tools, as building blocks in its software development) there is no "Open Source LTD" company that will alert you for the new zero-days which becomes known published vulnerability of one of your open source components (e.g. log4j) - the responsibility is yours!!!
Part of Security Posture Management is to know about each and every open source component you are using, get timely alerts on new vulnerabilities and take the right assessment about it (require patch/customer notification/update/commit/not exploitable).
This should be part of a written open-source organization policy where roles and processes are clearly defined.
It is a platform to monitor, assess and control cyber security risks for an organizations.
It integrates and centralizes the findings and remediation of all security issues / information coming from various security tools in phases of SAST, DAST, IAST etc.
Key points are observability and remediation capabilities at one place. This is an evolving area and will take some time to fully mature.
Few tools companies are claiming to be providing solutions for ASPM such as
@Evgeny Belenky
It is a platform to monitor, assess and control cyber security risks for an organizations.
It integrates and centralizes the findings and remediation of all security issues/information coming from various security tools in phases of SAST, DAST, IAST, etc.
Key points are observability and remediation capabilities at one place. This is an evolving area and will take some time to fully mature.
Few tools companies are claiming to be providing solutions for ASPM such as Armorcode, but I am yet to assess its capabilities.