Web Applications & APIs
|
|
|
- Leonard Cain
- 5 years ago
- Views:
Transcription
1 18 QUALYS SECURITY CONFERENCE 2018 Web Applications & APIs The Soft Belly of the Cloud Dave Ferguson Director, Product Management, WAS Remi Le Mer Director, Product Management, WAF
2 Agenda Web Apps & APIs in the Cloud Qualys Web Application Scanning (WAS) Review What's New Roadmap Qualys Web Application Firewall (WAF) Review Q&A What's New Roadmap 2
3 Insecure Apps & APIs are a Problem Your business depends on web applications Any app or API can be a foothold into your organization Developers are not incentivized for security Cloud-based apps are easy for developers to deploy Web Applications are Being Targeted! Most common data breach pattern *! Top hacking vector * U.S. Postal Service (API) Facebook (API) Google+ (API) MyFitnessPal (API?) Equifax Yahoo Ashley Madison * Source: 2018 Verizon DBIR
4 Apps & APIs are Everywhere Apps in Public Clouds Public-Facing Web Apps REST APIs Internal Web Apps New Apps under Development 4
5 Web Application Scanning Review
6 Qualys Web Application Scanning A leading dynamic application security testing (DAST) tool Delivered via the Qualys Cloud Platform Identifies app-layer vulnerabilities OWASP Top 10 CWEs Web-related CVEs Includes automated crawling Supports Selenium scripts Malware monitoring as a bonus 6
7 Built for the Enterprise Web App Discovery Unlimited scans & users RBAC Tagging Scheduled scans Ad-hoc, targeted scans Multi-site scans Retest vulnerability Scan for malware Massive scalability Detection history Scheduled reports Customizable reports Swagger support Robust API CI/CD integration Unique integration w/qualys WAF Integration with manual pen testing tools 7
8 What's New in Qualys WAS
9 Scanning REST APIs Swagger is specification that describes a set of REST APIs Swagger file typically available from dev team swagger.io Set Swagger file as target URL in Qualys WAS API endpoints are automatically tested for vulnerabilities Swagger v2 JSON format currently supported
10 Jenkins Plugin for WAS
11 Manual Testing Complements WAS Dynamic application testing is one piece of the AppSec puzzle Manual penetration testing important for your businesscritical apps Qualys WAS offers: Bugcrowd integration Burp Suite integration Partnerships with consulting shops 11
12 Bi-directional Integration with Bugcrowd 12
13 Qualys WAS Burp Extension Burp Suite A quick, intuitive way to send Burp-discovered issues into WAS Provides centralized viewing/reporting of WAS detections + Burp issues Available in Burp's BApp Store 13
14 Qualys WAS Burp extension
15 WAS Enhancements, YTD April 2018 Swagger Jenkins plugin Qualys Browser Recorder Test Authentication Exclude parameters June 2018 SSTI Header injection WebLogic RCE RichFaces RCE "Spring Break" Sept 2018 Browser engine upgrade XSS Power Mode Tag apps upon import ESI injection WebSocket detection PrimeFaces RCE Jan 2018 CMS vulns Multi-scan alerts Update QID mappings to 2017 OWASP Top 10 May 2018 Added CSV v2 report Add'l CMS vulns July 2018 Burp extension Results for cancelled scans Improved scan status Scan settings snapshot Retest multiple findings Oct 2018 Blueimp file upload Telerik crypto flaw 15
16 Qualys WAS Roadmap
17 WAS Roadmap Feb-Mar 2019 TLS 1.3 support SSL/TLS detections Out-of-band detections Security header tests Enhanced crawling CyberArk PIM integration Dec 2018 Blind XPATH injection Improved KB search Custom report footer Burp & Bugcrowd findings added to report Ignore finding time limit "Launch Now" for scheduled report Jan 2019 Custom scan intensity Jenkins plugin v2 Q2-Q Elasticsearch New dashboard UI modernization Support OpenAPI v3 Support Postman Collections 17
18 And Coming in 2019
19 Web Application Firewall Review
20 Qualys WAF Integration with WAS Architecture improvements Integration with Docker Security Improvements Roadmap standalone Roadmap Integrated Suite 20
21 WAS / WAF Integration: ScanTrust ScanTrust : Challenge your WAF protection Assess both the application and the policy that protects it 3. WAS Report 1. Request inspected and forwarded on server-side HTTP/S 2. WAF annotates HTTP responses with policy violations 21
22 WAS / WAF Integration: Virtual Patch Virtual Patch : One-click mitigation tool for CISO teams Run from within WAS to address confirmed threats
23 What's New in Qualys WAF
24 Supported Platforms Shared and Private Qualys Cloud Platforms 24
25 WAF Architecture Improvements Easy and Usable Architecture Virtual Reverse-Proxy Cluster-able within hybrid topologies Load-Balancing capabilities SSL/TLS cipher suite categories 25
26 WAF Architecture Improvements Virtual Appliance & Container (v1.5.3) XML/JSON content inspection Docker Host integration for backend automation Better performance Scheduled upgrades Orchestration via Qualys API 26
27 Docker Single Host Access t o docker services via unix socket s Controls : - containers (start stop delete inspect ) - networks - images (pull push delete) St ores images Container # 1 Container # 2 Container # 1 Container # 2 Web App B Web App A Web App A Web App B
28 Docker Multiple Hosts Access t o docker services via net w ork sockets Container # 1 Container # 1 Container # 2 Container # 1 Container # 2 Web App C Web App B Web App A Web App A Web App B
29 Security Improvements Custom Rules: write and manage your own filters XML/JSON inspection Virtual Patches and Event Exceptions Latency control Rewriting capabilities (headers) Qualys Rulesets and Templates DAG based inspection, programmable logic Drupal 8.0.x, Joomla 3.4.x, Magento , Wordpress 4.2.x-4.3.x JBoss 4.x-7.x, OWA , Sharepoint , Tomcat 8.0.x Qualys Generics for unknown apps 29
30 Qualys WAF Roadmap
31 WAF Roadmap - Standalone Mar 2019 Templates API Generics, Microsoft ADFS, JD Edwards Q Appliance empowered with Network Clustering Dec 2018 New Custom Rules keys +Community Library Revamped Security Events Jan 2019 Appliance Major Release (v1.6.0) TLSv1.3, HTTP/2, Improved network management capabilities Enriched CLI and local events logs Q Customizable Dashboard Alert Reports Improved RBAC Q Traffic Management ddos ip-reputation Bots Scraping 31
32 WAF Roadmap Integrated Suite Mar 2019 WAS reports with ScanTrust details Q Virtual Patch supports Burp and Bug Bounties Dec 2018 AI - Feed Application inventory with backend information Jan 2019 UD WAF widgets and queries Q App s Sitemap v2 (WAS & WAF) ScanTrust enabled on VM Q CV - fetch app s grade and patch SSL implementation 32
33 18 QUALYS SECURITY CONFERENCE 2018 Thank You Dave Ferguson - dferguson@qualys.com Remi Le Mer - rlemer@qualys.com
Web Applications & APIs
18 QUALYS SECURITY CONFERENCE 2018 Web Applications & APIs Application Security in a Devops world Pierrick Prevert Security Solutions Architect Remi Le Mer Director of Product Management, WAF Agenda Web
Web Application Firewall Getting Started Guide. September 7, 2018
Web Application Firewall Getting Started Guide September 7, 2018 Copyright 2014-2018 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other
Qualys Cloud Suite 2.x
Qualys Cloud Suite 2.x Version 2.34 August 29, 2018 Here s what s new in Qualys Cloud Suite 2.34! Continuous Monitoring License Counts are enforced for Continuous Monitoring Security Assessment Questionnaire
Automating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
Application Security Use Cases. RASP, WAF, NGWAF, What The Hell is The Difference.
Application Security Use Cases RASP, WAF, NGWAF, What The Hell is The Difference. Acronym Soup July 29, 2016 2 July 29, 2016 3 Definition of Terms WAF Web Application Firewall / waf / noun 1. An appliance,
Qualys Cloud Platform
18 QUALYS SECURITY CONFERENCE 2018 Qualys Cloud Platform Looking Under the Hood: What Makes Our Cloud Platform so Scalable and Powerful Dilip Bachwani Vice President, Engineering, Qualys, Inc. Cloud Platform
Community Edition Getting Started Guide. July 25, 2018
Community Edition Getting Started Guide July 25, 2018 Copyright 2018 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other trademarks are the
Application Security. Rafal Chrusciel Senior Security Operations Analyst, F5 Networks
Application Security Rafal Chrusciel Senior Security Operations Analyst, F5 Networks r.chrusciel@f5.com Agenda Who are we? Anti-Fraud F5 Silverline DDOS protection WAFaaS Threat intelligence & malware
Qualys Cloud Platform
Qualys Cloud Platform Our Journey into the Cloud: The Qualys Cloud Platform & Architecture Thomas Wendt Regional Manager Post-Sales, DACH, Qualys Inc. Digital Transformation More than just adopting new
Application security : going quicker
Application security : going quicker The web application firewall example Agenda Agenda o Intro o Application security o The dev team approach o The infra team approach o Impact of the agility o The WAF
Framework for Application Security Testing. September 11th, 2018
Framework for Application Security Testing September 11th, 2018 Create thousands of security tests from existing functional tests automatically Wallarm FAST enables secure CI / CD Wallarm FAST has many
86% of websites has at least 1 vulnerability and an average of 56 per website WhiteHat Security Statistics Report 2013
Vulnerabilities help make Web application attacks amongst the leading causes of data breaches +7 Million Exploitable Vulnerabilities challenge organizations today 86% of websites has at least 1 vulnerability
First Look Showcase. Expanding our prevention, detection and response solutions. Sumedh Thakar Chief Product Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Sumedh Thakar Chief Product Officer, Qualys, Inc. Secure Enterprise Mobility Identity (X.509,
Qualys Cloud Suite 2.30
Qualys Cloud Suite 2.30 Here s what s new in Qualys Cloud Suite 2.30! AssetView ThreatPROTECT Dynamic tag support for Amazon EC2 Metadata Search Assets by Amazon EC2 Metadata Cloud Agent Download Search
QUALYS SECURITY CONFERENCE Qualys CertView. Managing Digital Certificates. Jimmy Graham Senior Director, Product Management, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 Qualys CertView Managing Digital Certificates Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda Introduction Evolving browser markers Introducing
First Look Showcase. Expanding our prevention, detection and response solutions. Marco Rottigni Chief Technical Security Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Marco Rottigni Chief Technical Security Officer, Qualys, Inc. Secure Enterprise Mobility
ForeScout Extended Module for ServiceNow
ForeScout Extended Module for ServiceNow Version 1.2 Table of Contents About ServiceNow Integration... 4 Use Cases... 4 Asset Identification... 4 Asset Inventory True-up... 5 Additional ServiceNow Documentation...
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda
We b Ap p A t ac ks. U ser / Iden tity. P hysi ca l 11% Other (VPN, PoS,infra.)
We b Ap p A t ac ks U ser / Iden tity 33% 53% Apps And Identities Initial Targets In 86% Of Breaches P hysi ca l 11% Other (VPN, PoS,infra.) 3% Fix vulnerabilities Stop web attacks Risk & compliance What
Vulnerability Management & Vulnerability Assessment. Nessus Attack Scripting Language (NASL). CVE databases, NVD database
Case Study 2018 Solution/Service Title Vulnerability Management & Vulnerability Assessment Client Industry Cybersecurity, Vulnerability Assessment and Management, Network Security Client Overview Client
Qualys Cloud Platform
Qualys Cloud Platform Quick Tour The Qualys Cloud Platform is a platform of integrated solutions that provides businesses with asset discovery, network security, web application security, threat protection
Industry-leading Application PaaS Platform
Industry-leading Application PaaS Platform Solutions Transactional Apps Digital Marketing LoB App Modernization Services Web Apps Web App for Containers API Apps Mobile Apps IDE Enterprise Integration
Solutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
A10 HARMONY CONTROLLER
DATA SHEET A10 HARMONY CONTROLLER AGILE MANAGEMENT, AUTOMATION, ANALYTICS FOR MULTI-CLOUD ENVIRONMENTS PLATFORMS A10 Harmony Controller provides centralized agile management, automation and analytics for
TIBCO Cloud Integration Security Overview
TIBCO Cloud Integration Security Overview TIBCO Cloud Integration is secure, best-in-class Integration Platform as a Service (ipaas) software offered in a multi-tenant SaaS environment with centralized
ADC im Cloud - Zeitalter
ADC im Cloud - Zeitalter Applikationsdienste für Hybrid-Cloud- und Microservice-Szenarien Ralf Sydekum, SE Manager DACH, F5 Networks GmbH Some of the Public Cloud Related Questions You May Have.. It s
Qualys Cloud Suite 2.23
Qualys Cloud Suite 2.23 We re excited to tell you about improvements and enhancements in Qualys Cloud Suite 2.23. AssetView ThreatPROTECT Download List of Assets as Grouped on UI Download Details from
ForeScout Extended Module for Qualys VM
ForeScout Extended Module for Qualys VM Version 1.2.1 Table of Contents About the Qualys VM Integration... 3 Additional Qualys VM Documentation... 3 About This Module... 3 Components... 4 Considerations...
PEACHTECH PEACH API SECURITY AUTOMATING API SECURITY TESTING. Peach.tech
PEACH API SECURITY AUTOMATING API SECURITY TESTING Peach.tech Table of Contents Introduction... 3 Industry Trends... 3 API growth... 3 Agile and Continuous Development Frameworks... 4 Gaps in Tooling...
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Director, Product Management, Qualys, Inc. Agenda Expanding
McAfee Web Gateway Administration
McAfee Web Gateway Administration Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction to the tasks crucial
Web Application Firewall
Web Application Firewall Take chances with innovation, not security. HaltDos Web Application Firewall offers unmatched security capabilities, customization options and reporting analytics for the most
Imperva Incapsula Website Security
Imperva Incapsula Website Security DA T A SH E E T Application Security from the Cloud Imperva Incapsula cloud-based website security solution features the industry s leading WAF technology, as well as
McAfee Network Security Platform 8.3
8.3.7.28-8.3.7.6 Manager-Virtual IPS Release Notes McAfee Network Security Platform 8.3 Revision B Contents About this release New features Enhancements Resolved issues Installation instructions Known
Web Application Penetration Testing
Web Application Penetration Testing COURSE BROCHURE & SYLLABUS Course Overview Web Application penetration Testing (WAPT) is the Security testing techniques for vulnerabilities or security holes in corporate
haltdos - Web Application Firewall
haltdos - DATASHEET Delivering best-in-class protection for modern enterprise Protect your website against OWASP top-10 & Zero-day vulnerabilities, DDoS attacks, and more... Complete Attack Protection
Regaining Our Lost Visibility
18 QUALYS SECURITY CONFERENCE 2018 Regaining Our Lost Visibility Sumedh Thakar Chief Product Officer, Qualys, Inc. Agenda Why are we doing what we are doing? The State of IT Now Security Today The Future
Integrated Web Application Firewall & Distributed Denial of Service (DDoS) Mitigation Solution
Integrated Web Application Firewall & Distributed Denial of Service (DDoS) Mitigation Solution (Layer 3/4 and Layer 7) Delivering best-in-class network and web application security to the modern enterprise
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
ForeScout Extended Module for ServiceNow
ForeScout Extended Module for ServiceNow Version 1.1.0 Table of Contents About this Integration... 4 Use Cases... 4 Asset Identification... 4 Asset Inventory True-up... 5 Additional ServiceNow Documentation...
SOLUTION BRIEF CA API MANAGEMENT. Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management
SOLUTION BRIEF CA API MANAGEMENT Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management 2 SOLUTION BRIEF ENABLE AND PROTECT YOUR WEB APPLICATIONS WITH CA API MANAGEMENT ca.com
Web Application Firewall
Web Application Firewall Getting Started Guide Version 2.5 November 15, 2017 Copyright 2014-2017 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc.
McAfee Network Security Platform 8.3
8.3.7.28-8.3.3.9 Manager-Mxx30-series Release Notes McAfee Network Security Platform 8.3 Revision C Contents About this release New features Enhancements Resolved issues Installation instructions Known
SOLUTION BRIEF. Enabling and Securing Digital Business in API Economy. Protect APIs Serving Business Critical Applications
Enabling and Securing Digital Business in Economy Protect s Serving Business Critical Applications 40 percent of the world s web applications will use an interface Most enterprises today rely on customers
Defend Your Web Applications Against the OWASP Top 10 Security Risks. Speaker Name, Job Title
Defend Your Web Applications Against the OWASP Top 10 Security Risks Speaker Name, Job Title Application Security Is Business Continuity Maintain and grow revenue Identify industry threats Protect assets
F5 comprehensive protection against application attacks. Jakub Sumpich Territory Manager Eastern Europe
F5 comprehensive protection against application attacks Jakub Sumpich Territory Manager Eastern Europe j.sumpich@f5.com Evolving Security Threat Landscape cookie tampering Identity Extraction DNS Cache
Herding Cats. Carl Brothers, F5 Field Systems Engineer
Herding Cats Carl Brothers, F5 Field Systems Engineer Agenda Introductions Security is easy, right Trivia Protecting your apps, one layer at a time How to survive an Attack Time permitting F5 Networks,
Integrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises
Integrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises AI-driven website & network protection service that secures online businesses from today's
THE THREE WAYS OF SECURITY. Jeff Williams Co-founder and CTO Contrast Security
THE THREE WAYS OF SECURITY Jeff Williams Co-founder and CTO Contrast Security 1. TODAY S AVERAGE APPLICATION IS A SECURITY DISASTER 2. SOFTWARE IS LEAVING SECURITY IN THE DUST SOFTWARE Typical enterprise
The Bots Are Coming The Bots Are Coming Scott Taylor Director, Solutions Engineering
The Bots Are Coming The Bots Are Coming Scott Taylor Director, Solutions Engineering Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information
Running MarkLogic in Containers (Both Docker and Kubernetes)
Running MarkLogic in Containers (Both Docker and Kubernetes) Emma Liu Product Manager, MarkLogic Vitaly Korolev Staff QA Engineer, MarkLogic @vitaly_korolev 4 June 2018 MARKLOGIC CORPORATION Source: http://turnoff.us/image/en/tech-adoption.png
CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR
PDF NESSUS VULNERABILITY SCANNER - BASICS - SECURITYLEARN CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR 1 / 6 2 / 6 3 / 6 website vulnerability scanner pdf Basics vulnerability scanning with NESSUS...
DefectDojo. The Good, the Bad and the Ugly. OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider
DefectDojo The Good, the Bad and the Ugly OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider 2018-05-31 PREFACE CIO: What is the security posture of our applications? How do you handle and communicate
Application Security at DevOps Speed and Portfolio Scale. Jeff Contrast Security
Application Security at DevOps Speed and Portfolio Scale Jeff Williams @planetlevel Contrast Security OWASP XSS Prevention Cheat Sheet 1,000,000 Page Views! https://www.owasp.org/index.php/xss_(cross_site_scripting)_prevention_cheat_sheet
En partenariat avec CA Technologies. Genève, Hôtel Warwick,
SIGS Afterwork Event in Geneva API Security as Part of Digital Transformation Projects The role of API security in digital transformation Nagib Aouini, Head of Cyber Security Services Defense & Cyber Security
Version 2.38 April 18, 2019
Version 2.38 April 18, 2019 in Qualys Cloud Suite 2.38! AssetView Azure Instance State search token and Dynamic Tag Support Security Assessment Questionnaire New Search Option for Template Selection Web
WEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM
SECURITY ANALYTICS WEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM BLAZING PERFORMANCE, HIGH AVAILABILITY AND ROBUST SECURITY FOR YOUR CRITICAL WEB APPLICATIONS OVERVIEW Webscale is a converged multi-cloud
BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION
GUIDE BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION CONTINUOUS SECURITY With attackers getting more sophisticated every day, manual methods of locating and testing web-based apps
OpenShift Roadmap Enterprise Kubernetes for Developers. Clayton Coleman, Architect, OpenShift
OpenShift Roadmap Enterprise Kubernetes for Developers Clayton Coleman, Architect, OpenShift What Is OpenShift? Application-centric Platform INFRASTRUCTURE APPLICATIONS Use containers for efficiency Hide
EFFECTIVE, SCALABLE, #FULLSTACK VULNERABILITY MANAGEMENT
EFFECTIVE, SCALABLE, #FULLSTACK VULNERABILITY MANAGEMENT edgescan Portal ABOUT EDGESCAN SaaS: edgescan is a Security-as-a-Service (SaaS) vulnerability management service which detects vulnerabilities in
DevSecOps Shift Left Security. Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis
DevSecOps Shift Left Security Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis Themes Vulnerabilities are Low Hanging Fruit Why so many breaches that Anti-Virus
DDoS Hybrid Defender. SSL Orchestrator. Comprehensive DDoS protection, tightly-integrated on-premises and cloud
SSL Orchestrator DDoS Hybrid Defender All-in-one solution designed to deliver increased visibility into encrypted traffic Comprehensive DDoS protection, tightly-integrated on-premises and cloud Converts
NoScript, CSP and ABE: When The Browser Is Not Your Enemy
NoScript, CSP and ABE: When The Browser Is Not Your Enemy Giorgio Maone CTO, NoScript lead developer InformAction OWASP-Italy Day IV Milan 6th, November 2009 Copyright 2008 - The OWASP Foundation Permission
Qualys Cloud Platform (VM, PC) v8.x Release Notes
Qualys Cloud Platform (VM, PC) v8.x Release Notes Version 8.18 March 11, 2019 This new release of the Qualys Cloud Platform (VM, PC) includes improvements to Vulnerability Management and Policy Compliance.
Everything visible. Everything secure.
Everything visible. Everything secure. Unparalleled visibility, end-to-end security and compliance for all your global IT assets Qualys Cloud Platform 2-second visibility across all your assets Continuous
1. APPLICATION SECURITY: KEY CHALLENGES
DATA SHEET PT APPLICATION FIREWALL DATA SHEET 1. APPLICATION SECURITY: KEY CHALLENGES Almost every modern enterprise uses hundreds of web, mobile or ERP applications to help run their operations. But as
Going Without CPU Patches on Oracle E-Business Suite 11i?
Going Without CPU Patches on E-Business Suite 11i? September 17, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About
CIS 700/002 : Special Topics : OWASP ZED (ZAP)
CIS 700/002 : Special Topics : OWASP ZED (ZAP) Hitali Sheth CIS 700/002: Security of EMBS/CPS/IoT Department of Computer and Information Science School of Engineering and Applied Science University of
Comodo cwatch Web Security Software Version 1.6
rat Comodo cwatch Web Security Software Version 1.6 Quick Start Guide Guide Version 1.6.010918 Comodo Security Solutions 1255 Broad Street Clifton, NJ 07013 Comodo cwatch Web Security - Quick Start Guide
ForeScout Extended Module for IBM BigFix
ForeScout Extended Module for IBM BigFix Version 1.0.0 Table of Contents About this Integration... 4 Use Cases... 4 Additional BigFix Documentation... 4 About this Module... 4 Concepts, Components, Considerations...
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
Kishin Fatnani. Founder & Director K-Secure. Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009
Securing Web Applications: Defense Mechanisms Kishin Fatnani Founder & Director K-Secure Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009 1 Agenda Current scenario in Web Application
AWS Web Application Firewall. Darren Weiner Cloud Architect/Engineer
AWS Web Application Firewall Darren Weiner Cloud Architect/Engineer My journey 20 years in IT 8 years in the cloud Rode the.com wave Web Admin DBA IT Director Cloud Consulting Today s Journey Adoption
OWASP TOP Release. Andy Willingham June 12, 2018 OWASP Cincinnati
OWASP TOP 10 2017 Release Andy Willingham June 12, 2018 OWASP Cincinnati Agenda A quick history lesson The Top 10(s) Web Mobile Privacy Protective Controls Why have a Top 10? Software runs the world (infrastructure,
Secure DevOps: A Puma s Tail
Secure DevOps: A Puma s Tail SANS Secure DevOps Summit Tuesday, October 10th 2017 Eric Johnson (@emjohn20) Eric Johnson, CISSP, GSSP, GWAPT Cypress Data Defense Principal Security Consultant Static code
Securing Your Amazon Web Services Virtual Networks
Securing Your Amazon Web Services s IPS security for public cloud deployments It s no surprise that public cloud infrastructure has experienced fast adoption. It is quick and easy to spin up a workload,
Qualys Cloud Platform (VM, PC) v8.x Release Notes
Qualys Cloud Platform (VM, PC) v8.x Release Notes Version 8.16 December 14, 2018 This new release of the Qualys Cloud Platform (VM, PC) includes improvements to Vulnerability Management and Policy Compliance.
Taking Control of Your Application Security
EDUCAUSE Wednesday, May 3 rd Taking Control of Your Application Security 2017 SANS Institute All Rights Reserved INTRODUCTION Eric Johnson, CISSP, GSSP-Java, GSSP-.NET, GWAPT Application Security Curriculum
Chapter 5: Vulnerability Analysis
Chapter 5: Vulnerability Analysis Technology Brief Vulnerability analysis is a part of the scanning phase. In the Hacking cycle, vulnerability analysis is a major and important part. In this chapter, we
A10 Lightning Application Delivery Service
Datasheet A10 Lightning Application Delivery Service Application Traffic Management, Security and Analytics in Public, Private & Hybrid Clouds Overview The A10 Lightning Application Delivery Service (ADS)
CONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WHITEPAPER
WHITEPAPER CONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WELCOME TO THE ERA OF SELF-PROTECTING SOFTWARE CONTRASTSECURITY.COM CONTENTS What is Interactive
VMware AirWatch Content Gateway for Linux. VMware Workspace ONE UEM 1811 Unified Access Gateway
VMware AirWatch Content Gateway for Linux VMware Workspace ONE UEM 1811 Unified Access Gateway You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/
Continuous Delivery for Cloud Native Applications
Continuous Delivery for Cloud Native Applications Cyrille Le Clerc, Director, Product Management at CloudBees Bjorn Boe, Senior Field Engineer at Pivotal Software Speakers /Cyrille Le Clerc Product Manager
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda
Tenable.io Web Application Scanning. Last Updated: November 19, 2018
Tenable.io Web Application Scanning Last Updated: November 19, 2018 Table of Contents Tenable.io Web Application Scanning 1 Welcome to Tenable.io Web Application Scanning 4 Get Started with Tenable.io
LaunchStation Controller
LaunchStation Controller Software Defined Labs Platform for Hybrid Network Management, Topology Orchestration, Advanced Automation, & Resource Utilization LaunchStation Overview Tokalabs LaunchStation
F5 Synthesis Information Session. April, 2014
F5 Synthesis Information Session April, 2014 Agenda Welcome and Introduction to Customer Technology Challenges Software Defined Application Services Reference Architectures for Today s Customer Challenges
Comodo Certificate Manager
Comodo Certificate Manager Simple, Automated & Robust SSL Management from the #1 Provider of Digital Certificates 1 Datasheet Table of Contents Introduction 3 CCM Overview 4 Certificate Discovery Certificate
Configuring Vulnerability Assessment Devices
CHAPTER 10 Revised: November 10, 2007 Vulnerability assessment (VA) devices provide MARS with valuable information about many of the possible targets of attacks and threats. They provide information useful
WHITEHAT SECURITY. T.C. NIEDZIALKOWSKI Technical Evangelist. DECEMBER 2012
WHITEHAT SECURITY DECEMBER 2012 T.C. NIEDZIALKOWSKI Technical Evangelist tc@whitehatsec.com WhiteHat Security Company Overview Headquartered in Santa Clara, CA WhiteHat Sentinel SaaS end-to-end website
The SANS Institute Top 20 Critical Security Controls. Compliance Guide
The SANS Institute Top 20 Critical Security Controls Compliance Guide February 2014 The Need for a Risk-Based Approach A common factor across many recent security breaches is that the targeted enterprise
Securing Your Microsoft Azure Virtual Networks
Securing Your Microsoft Azure Virtual Networks IPS security for public cloud deployments It s no surprise that public cloud infrastructure has experienced fast adoption. It is quick and easy to spin up
Qualys Cloud Suite 2.28
Qualys Cloud Suite 2.28 We re excited to tell you about improvements and enhancements in Qualys Cloud Suite 2.28. AssetView ThreatPROTECT View Policy Compliance Summary in Asset Details Export Dashboards
Corrigendum 3. Tender Number: 10/ dated
(A premier Public Sector Bank) Information Technology Division Head Office, Mangalore Corrigendum 3 Tender Number: 10/2016-17 dated 07.09.2016 for Supply, Installation and Maintenance of Distributed Denial
Our sponsors Zequi V Autopsy of Vulnerabilities
Our sponsors Our sponsors Our sponsors About me Who s me? Ezequiel Zequi Vázquez Backend Developer Sysadmin & DevOps Hacking & Security Speaker since 2013 About me Index 1 Introduction 2 Analysis of Vulnerabilities
Deployment Scenarios Microsoft TMG Standard, TMG Enterprise, TMG Branch Office series Appliances
Deployment Scenarios Microsoft TMG Standard, TMG Enterprise, TMG Branch Office series Appliances TMG Server 2010 Appliance (ntmg or ntmge Series) provides value to IT managers, network administrators,
The Way of the Bounty. by David Sopas
The Way of the Bounty by David Sopas (@dsopas) ./whoami Security Consultant for Checkmarx Security Team Leader for Char49 Disclosed more than 50 security advisories Founder of WebSegura.net Love to hack
How to Secure Your Cloud with...a Cloud?
A New Era of Thinking How to Secure Your Cloud with...a Cloud? Eitan Worcel Offering Manager - Application Security on Cloud IBM Security 1 2016 IBM Corporation 1 A New Era of Thinking Agenda IBM Cloud
ForeScout Extended Module for Tenable Vulnerability Management
ForeScout Extended Module for Tenable Vulnerability Management Version 2.7.1 Table of Contents About Tenable Vulnerability Management Module... 4 Compatible Tenable Vulnerability Products... 4 About Support
Qualys 8.7 Release Notes
Qualys 8.7 Release Notes This new release of the Qualys Cloud Suite of Security and Compliance Applications includes improvements to Vulnerability Management and Policy Compliance. Qualys Cloud Platform