Web Applications & APIs
|
|
|
- Beverly Summers
- 5 years ago
- Views:
Transcription
1 18 QUALYS SECURITY CONFERENCE 2018 Web Applications & APIs Application Security in a Devops world Pierrick Prevert Security Solutions Architect Remi Le Mer Director of Product Management, WAF
2 Agenda Web Applications & APIs: where are we now? Web Security Built-in, not bolted on Qualys Web Application Scanning Review What's New Roadmap Qualys Web Application Firewall Review What's New Roadmap Bug Bounty, a new horizon? Q&A 2
3 Apps & APIs are Everywhere Apps in Public Clouds Public-Facing Web Apps REST APIs Internal Web Apps New Apps under Development 3
4 Insecure Apps & APIs are a Problem Business depends on web applications Web Applications are Being Targeted! Most common data breach pattern *! Top hacking vector * Any of them can be a foothold into your organization Developers are not incentivized for security U.S. Postal Service (API) Facebook (API) Google+ (API) MyFitnessPal (API?) Equifax Yahoo Ashley Madison Cloud-based apps are easy for developers to deploy * Source: 2018 Verizon DBIR 4
5 Devops challenges how security is done Security should start in dev Security should be a continuous effort Security is a global concern CI/CD Tools are powerful New challenges: What is in production? What server is this app on? CI/CD pipe s privileges? Inefficient/late security Slowed-down delivery 5
6 Web Application Security Built-in Not bolted on
7 Traditional AppSec Operations business dev integration assessment and mitigation remediation production «I need this app» «it s urgent» InfoSec «it s strategic» 7
8 The way of the DevSecOps Source Control Merges, Pulls, Builds Pre-Prod Test/QA Staging Dev Environment Go Prod? Developers Commit Jenkins (CI/CD tool) Connector Deploy WAF API Engine Engine Scan Qualys Firewall Appliance Scantrust Infosec/SOC WAS Engine API Engine Qualys Scanner Appliance 8
9 WAS / WAF Integration: ScanTrust ScanTrust : Challenge your WAF protection Assess both the application and the policy that protects it 3. WAS Report 1. Request inspected and forwarded on server-side HTTP/S 2. WAF annotates HTTP responses with policy violations 9
10 WAS / WAF Integration: Virtual Patch Virtual Patch : One-click mitigation tool for CISO teams Run from within WAS to address confirmed threats
11 And Coming in 2019
12 Web Application Scanning Review
13 Qualys WAS A leading dynamic application security testing (DAST) tool Delivered via the Qualys Cloud Platform Identifies app-layer vulnerabilities OWASP Top 10 CWEs Web-related CVEs Includes automated crawling Supports Selenium scripts Malware monitoring as a bonus 13
14 Built for the Enterprise Web App Discovery Unlimited scans & users RBAC Tagging Scheduled scans Ad-hoc, targeted scans Multi-site scans Retest vulnerability Scan for malware Massive scalability Detection history Scheduled reports Customizable reports Swagger support Robust API CI/CD integration Unique integration w/qualys WAF Integration with manual pen testing tools 14
15 What's New in Qualys WAS
16 Scanning REST APIs Swagger is specification that describes a set of REST APIs Swagger file typically available from dev team swagger.io Set Swagger file as target URL in Qualys WAS API endpoints are automatically tested for vulnerabilities Swagger v2 JSON format currently supported
17 Jenkins Plugin for WAS
18 Manual Testing Complements WAS Dynamic application testing is one piece of the AppSec puzzle Manual penetration testing important for your business-critical apps Qualys WAS offers: Bugcrowd integration Burp Suite integration Partnerships with consulting shops 18
19 Bi-directional Integration with Bugcrowd 19
20 Qualys WAS Burp Extension Burp Suite A quick, intuitive way to send Burp-discovered issues into WAS Provides centralized viewing/reporting of WAS detections + Burp issues Available in Burp's BApp Store 20
21 Qualys WAS Burp extension
22 WAS Enhancements, YTD April 2018 Swagger Jenkins plugin Qualys Browser Recorder Test Authentication Exclude parameters June 2018 SSTI Header injection WebLogic RCE RichFaces RCE "Spring Break" Sept 2018 Browser engine upgrade XSS Power Mode Tag apps upon import ESI injection WebSocket detection PrimeFaces RCE Jan 2018 CMS vulns Multi-scan alerts Update QID mappings to 2017 OWASP Top 10 May 2018 Added CSV v2 report Add'l CMS vulns July 2018 Burp extension Results for cancelled scans Improved scan status Scan settings snapshot Retest multiple findings Oct 2018 Blueimp file upload Telerik crypto flaw 22
23 Qualys WAS Roadmap
24 WAS Roadmap Feb-Mar 2019 TLS 1.3 support SSL/TLS detections Out-of-band detections Security header tests Enhanced crawling CyberArk PIM integration Dec 2018 Blind XPATH injection Improved KB search Custom report footer Burp & Bugcrowd findings added to report Ignore finding time limit "Launch Now" for scheduled report Jan 2019 Custom scan intensity Jenkins plugin v2 Q2-Q Elasticsearch New dashboard UI modernization Support OpenAPI v3 Support Postman Collections 24
25 Web Application Firewall Review
26 Qualys WAF Integration with WAS Architecture improvements Integration with Docker Security Improvements Roadmap standalone Roadmap Integrated Suite 26
27 What's New in Qualys WAF
28 Supported Platforms Shared and Private Qualys Cloud Platforms 28
29 WAF Virtual Appliance Easy and usable Architecture Virtual Reverse-Proxy Cluster-able within hybrid topologies Load-Balancing capabilities SSL/TLS cipher suite categories 29
30 WAF Improvements Virtual Appliance & Container (v1.5.3) XML/JSON content inspection Docker Host integration for backend automation Better performance Scheduled upgrades Orchestration via Qualys API 30
31 Docker Single Host Access t o docker services via unix socket s Controls : - containers (start stop delete inspect ) - networks - images (pull push delete) St ores images Container # 1 Container # 2 Container # 1 Container # 2 Web App B Web App A Web App A Web App B
32 Docker Multiple Hosts Access t o docker services via net w ork sockets Container # 1 Container # 1 Container # 2 Container # 1 Container # 2 Web App C Web App B Web App A Web App A Web App B
33 Security Improvements Custom Rules: write and manage your own filters XML/JSON inspection Virtual Patches and Event Exceptions Latency control Rewriting capabilities (headers) Qualys Rulesets and Templates DAG based inspection, programmable logic Drupal 8.0.x, Joomla 3.4.x, Magento , Wordpress 4.2.x-4.3.x JBoss 4.x-7.x, OWA , Sharepoint , Tomcat 8.0.x Qualys Generics for unknown apps 33
34 Qualys WAF Roadmap
35 WAF Roadmap - Standalone Mar 2019 Templates API Generics, Microsoft ADFS, JD Edwards Q Appliance empowered with Network Clustering Dec 2018 New Custom Rules keys +Community Library Revamped Security Events Jan 2019 Appliance Major Release (v1.6.0) TLSv1.3, HTTP/2, Improved network management capabilities Enriched CLI and local events logs Q Customizable Dashboard Alert Reports Improved RBAC Q Traffic Management ddos ip-reputation Bots Scraping 35
36 WAF Roadmap Integrated Suite Mar 2019 WAS reports with ScanTrust details Q Virtual Patch supports Burp and Bug Bounties Dec 2018 AI - Feed Application inventory with backend information Jan 2019 UD WAF widgets and queries Q App s Sitemap v2 (WAS & WAF) ScanTrust enabled on VM Q CV - fetch app s grade and patch SSL implementation 36
37 Web Applications & APIs Intégration et capitalisation des données issues d un programme de Bug Bounty Romain Lecoeuvre Co-Fondateur & CTO
38 Un peu d histoire Le principe du Bug Bounty remonte à 1983, développé à partir de 1995 par Netscape pour permettre à une organisation d'améliorer la sécurité de son système d'information en s'appuyant sur une communauté de chercheurs en vulnérabilités (Crowdsecurity). 38
39 YesWeHack en chiffres chercheurs inscrits 120+ nationalités 65% d Européens rapports de vulnérabilités 39
40 Structure d un rapport 40
41 Intégration? Récupération des nouveaux rapports de vulnérabilités via API Intégration des rapports qualifiés dans un Bug Tracker (Bitbucket, git, jira, etc.) 41
42 Intégration? Agent de contrôle intégré dans la CI Contrôle entre les rapports de vulnérabilités valides et les tests fonctionnels «sécurité» Non-regression 42
43 Capitalisation? API Bug Bounty TESTING Developers Agent Test Commit Deploy Production 43
44 Capitalisation? Agent intégré dans les applications métiers IA Scanner SIEM SOC WAF 44
45 Capitalisation? API Bug Bounty Agent SSI IA Scanner SIEM SOC WAF 45
46 Capitalisation? 46
47 Q&A
48 18 QUALYS SECURITY CONFERENCE 2018 Thank You Romain Lecoeuvre - rlecoeuvre@yeswehack.com Pierrick Prevert - pprevert@qualys.com Remi Le Mer - rlemer@qualys.com
Web Applications & APIs
18 QUALYS SECURITY CONFERENCE 2018 Web Applications & APIs The Soft Belly of the Cloud Dave Ferguson Director, Product Management, WAS Remi Le Mer Director, Product Management, WAF Agenda Web Apps & APIs
Automating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
Qualys Cloud Platform
18 QUALYS SECURITY CONFERENCE 2018 Qualys Cloud Platform Looking Under the Hood: What Makes Our Cloud Platform so Scalable and Powerful Dilip Bachwani Vice President, Engineering, Qualys, Inc. Cloud Platform
Web Application Firewall Getting Started Guide. September 7, 2018
Web Application Firewall Getting Started Guide September 7, 2018 Copyright 2014-2018 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other
Qualys Cloud Platform
Qualys Cloud Platform Our Journey into the Cloud: The Qualys Cloud Platform & Architecture Thomas Wendt Regional Manager Post-Sales, DACH, Qualys Inc. Digital Transformation More than just adopting new
Qualys Cloud Suite 2.x
Qualys Cloud Suite 2.x Version 2.34 August 29, 2018 Here s what s new in Qualys Cloud Suite 2.34! Continuous Monitoring License Counts are enforced for Continuous Monitoring Security Assessment Questionnaire
Framework for Application Security Testing. September 11th, 2018
Framework for Application Security Testing September 11th, 2018 Create thousands of security tests from existing functional tests automatically Wallarm FAST enables secure CI / CD Wallarm FAST has many
THE THREE WAYS OF SECURITY. Jeff Williams Co-founder and CTO Contrast Security
THE THREE WAYS OF SECURITY Jeff Williams Co-founder and CTO Contrast Security 1. TODAY S AVERAGE APPLICATION IS A SECURITY DISASTER 2. SOFTWARE IS LEAVING SECURITY IN THE DUST SOFTWARE Typical enterprise
Application security : going quicker
Application security : going quicker The web application firewall example Agenda Agenda o Intro o Application security o The dev team approach o The infra team approach o Impact of the agility o The WAF
QUALYS SECURITY CONFERENCE Qualys CertView. Managing Digital Certificates. Jimmy Graham Senior Director, Product Management, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 Qualys CertView Managing Digital Certificates Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda Introduction Evolving browser markers Introducing
Community Edition Getting Started Guide. July 25, 2018
Community Edition Getting Started Guide July 25, 2018 Copyright 2018 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc. All other trademarks are the
DevSecOps Shift Left Security. Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis
DevSecOps Shift Left Security Prioritizing Incident Response using Security Posture Assessment and Attack Surface Analysis Themes Vulnerabilities are Low Hanging Fruit Why so many breaches that Anti-Virus
Application Security Use Cases. RASP, WAF, NGWAF, What The Hell is The Difference.
Application Security Use Cases RASP, WAF, NGWAF, What The Hell is The Difference. Acronym Soup July 29, 2016 2 July 29, 2016 3 Definition of Terms WAF Web Application Firewall / waf / noun 1. An appliance,
Regaining Our Lost Visibility
18 QUALYS SECURITY CONFERENCE 2018 Regaining Our Lost Visibility Sumedh Thakar Chief Product Officer, Qualys, Inc. Agenda Why are we doing what we are doing? The State of IT Now Security Today The Future
First Look Showcase. Expanding our prevention, detection and response solutions. Sumedh Thakar Chief Product Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Sumedh Thakar Chief Product Officer, Qualys, Inc. Secure Enterprise Mobility Identity (X.509,
Application Security. Rafal Chrusciel Senior Security Operations Analyst, F5 Networks
Application Security Rafal Chrusciel Senior Security Operations Analyst, F5 Networks r.chrusciel@f5.com Agenda Who are we? Anti-Fraud F5 Silverline DDOS protection WAFaaS Threat intelligence & malware
First Look Showcase. Expanding our prevention, detection and response solutions. Marco Rottigni Chief Technical Security Officer, Qualys, Inc.
18 QUALYS SECURITY CONFERENCE 2018 First Look Showcase Expanding our prevention, detection and response solutions Marco Rottigni Chief Technical Security Officer, Qualys, Inc. Secure Enterprise Mobility
Qualys Cloud Suite 2.30
Qualys Cloud Suite 2.30 Here s what s new in Qualys Cloud Suite 2.30! AssetView ThreatPROTECT Dynamic tag support for Amazon EC2 Metadata Search Assets by Amazon EC2 Metadata Cloud Agent Download Search
NOTHING IS WHAT IT SIEMs: COVER PAGE. Simpler Way to Effective Threat Management TEMPLATE. Dan Pitman Principal Security Architect
NOTHING IS WHAT IT SIEMs: COVER PAGE Simpler Way to Effective Threat Management TEMPLATE Dan Pitman Principal Security Architect Cybersecurity is harder than it should be 2 SIEM can be harder than it should
PEACHTECH PEACH API SECURITY AUTOMATING API SECURITY TESTING. Peach.tech
PEACH API SECURITY AUTOMATING API SECURITY TESTING Peach.tech Table of Contents Introduction... 3 Industry Trends... 3 API growth... 3 Agile and Continuous Development Frameworks... 4 Gaps in Tooling...
ForeScout Extended Module for ServiceNow
ForeScout Extended Module for ServiceNow Version 1.2 Table of Contents About ServiceNow Integration... 4 Use Cases... 4 Asset Identification... 4 Asset Inventory True-up... 5 Additional ServiceNow Documentation...
86% of websites has at least 1 vulnerability and an average of 56 per website WhiteHat Security Statistics Report 2013
Vulnerabilities help make Web application attacks amongst the leading causes of data breaches +7 Million Exploitable Vulnerabilities challenge organizations today 86% of websites has at least 1 vulnerability
Qualys Cloud Platform
Qualys Cloud Platform Quick Tour The Qualys Cloud Platform is a platform of integrated solutions that provides businesses with asset discovery, network security, web application security, threat protection
A10 HARMONY CONTROLLER
DATA SHEET A10 HARMONY CONTROLLER AGILE MANAGEMENT, AUTOMATION, ANALYTICS FOR MULTI-CLOUD ENVIRONMENTS PLATFORMS A10 Harmony Controller provides centralized agile management, automation and analytics for
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda
Solutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
Secure DevOps: A Puma s Tail
Secure DevOps: A Puma s Tail SANS Secure DevOps Summit Tuesday, October 10th 2017 Eric Johnson (@emjohn20) Eric Johnson, CISSP, GSSP, GWAPT Cypress Data Defense Principal Security Consultant Static code
DefectDojo. The Good, the Bad and the Ugly. OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider
DefectDojo The Good, the Bad and the Ugly OWASP Stammtisch Hamburg Tilmann Haak Manuel Schneider 2018-05-31 PREFACE CIO: What is the security posture of our applications? How do you handle and communicate
DevOps Anti-Patterns. Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! COPYRIGHT 2019 MANICODE SECURITY
DevOps Anti-Patterns Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! 31 Anti-Pattern: Throw it Over the Wall Development Operations 32 Anti-Pattern: DevOps Team Silo
Vulnerability Management & Vulnerability Assessment. Nessus Attack Scripting Language (NASL). CVE databases, NVD database
Case Study 2018 Solution/Service Title Vulnerability Management & Vulnerability Assessment Client Industry Cybersecurity, Vulnerability Assessment and Management, Network Security Client Overview Client
We b Ap p A t ac ks. U ser / Iden tity. P hysi ca l 11% Other (VPN, PoS,infra.)
We b Ap p A t ac ks U ser / Iden tity 33% 53% Apps And Identities Initial Targets In 86% Of Breaches P hysi ca l 11% Other (VPN, PoS,infra.) 3% Fix vulnerabilities Stop web attacks Risk & compliance What
Imperva Incapsula Website Security
Imperva Incapsula Website Security DA T A SH E E T Application Security from the Cloud Imperva Incapsula cloud-based website security solution features the industry s leading WAF technology, as well as
ForeScout Extended Module for Qualys VM
ForeScout Extended Module for Qualys VM Version 1.2.1 Table of Contents About the Qualys VM Integration... 3 Additional Qualys VM Documentation... 3 About This Module... 3 Components... 4 Considerations...
ADC im Cloud - Zeitalter
ADC im Cloud - Zeitalter Applikationsdienste für Hybrid-Cloud- und Microservice-Szenarien Ralf Sydekum, SE Manager DACH, F5 Networks GmbH Some of the Public Cloud Related Questions You May Have.. It s
Industry-leading Application PaaS Platform
Industry-leading Application PaaS Platform Solutions Transactional Apps Digital Marketing LoB App Modernization Services Web Apps Web App for Containers API Apps Mobile Apps IDE Enterprise Integration
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Director, Product Management, Qualys, Inc. Agenda Expanding
Qualys Cloud Suite 2.23
Qualys Cloud Suite 2.23 We re excited to tell you about improvements and enhancements in Qualys Cloud Suite 2.23. AssetView ThreatPROTECT Download List of Assets as Grouped on UI Download Details from
CONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WHITEPAPER
WHITEPAPER CONTRAST ASSESS MARKET-DEFINING APPLICATION SECURITY TESTING FOR MODERN AGILE AND DEVOPS TEAMS WELCOME TO THE ERA OF SELF-PROTECTING SOFTWARE CONTRASTSECURITY.COM CONTENTS What is Interactive
EFFECTIVE, SCALABLE, #FULLSTACK VULNERABILITY MANAGEMENT
EFFECTIVE, SCALABLE, #FULLSTACK VULNERABILITY MANAGEMENT edgescan Portal ABOUT EDGESCAN SaaS: edgescan is a Security-as-a-Service (SaaS) vulnerability management service which detects vulnerabilities in
Everything visible. Everything secure.
Everything visible. Everything secure. Unparalleled visibility, end-to-end security and compliance for all your global IT assets Qualys Cloud Platform 2-second visibility across all your assets Continuous
Azure DevOps. Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region
Azure DevOps Randy Pagels Intelligent Cloud Technical Specialist Great Lakes Region What is DevOps? People. Process. Products. Build & Test Deploy DevOps is the union of people, process, and products to
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
Managing an Application Vulnerability Management Program in a CI/CD Environment. March 29, 2018 OWASP Vancouver - Karim Lalji 1
Managing an Application Vulnerability Management Program in a CI/CD Environment March 29, 2018 OWASP Vancouver - Karim Lalji 1 About Me Karim Lalji Managing Security Consultant (VA/PT) at TELUS Previously:
DevOps Course Content
DevOps Course Content 1. Introduction: Understanding Development Development SDLC using WaterFall & Agile Understanding Operations DevOps to the rescue What is DevOps DevOps SDLC Continuous Delivery model
ForeScout Extended Module for ServiceNow
ForeScout Extended Module for ServiceNow Version 1.1.0 Table of Contents About this Integration... 4 Use Cases... 4 Asset Identification... 4 Asset Inventory True-up... 5 Additional ServiceNow Documentation...
The Bots Are Coming The Bots Are Coming Scott Taylor Director, Solutions Engineering
The Bots Are Coming The Bots Are Coming Scott Taylor Director, Solutions Engineering Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information
Application Security at Scale
Jake Marcinko Standards Manager, PCI Security Standards Council Jeff Williams CTO, Contrast Security Application Security at Scale AppSec at Scale Delivering Timely Security Solutions / Services to Meet
F5 comprehensive protection against application attacks. Jakub Sumpich Territory Manager Eastern Europe
F5 comprehensive protection against application attacks Jakub Sumpich Territory Manager Eastern Europe j.sumpich@f5.com Evolving Security Threat Landscape cookie tampering Identity Extraction DNS Cache
BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION
GUIDE BEST PRACTICES FOR SELECTING A WEB APPLICATION SCANNING (WAS) SOLUTION CONTINUOUS SECURITY With attackers getting more sophisticated every day, manual methods of locating and testing web-based apps
Robots with Pentest Recipes:
Robots with Pentest Recipes: Democratizing Security Testing for DevOps Wins Abhay Bhargav - CTO, we45 Yours Truly Co-author of Secure Java For Web Application Development Author of PCI Compliance: A Definitive
Herding Cats. Carl Brothers, F5 Field Systems Engineer
Herding Cats Carl Brothers, F5 Field Systems Engineer Agenda Introductions Security is easy, right Trivia Protecting your apps, one layer at a time How to survive an Attack Time permitting F5 Networks,
CyberSecurity: Top 20 Controls
CyberSecurity: Top 20 Controls ISACA Kampala Chapter CPD Event - 30 March 2017 By Bernard Wanyama - CISA, CGEIT, CRISC, CISM Assume breach.. The CIS Top 20 Critical Security Controls CIS, SANS, NSA and
Going Without CPU Patches on Oracle E-Business Suite 11i?
Going Without CPU Patches on E-Business Suite 11i? September 17, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About
Continuous Delivery for Cloud Native Applications
Continuous Delivery for Cloud Native Applications Cyrille Le Clerc, Director, Product Management at CloudBees Bjorn Boe, Senior Field Engineer at Pivotal Software Speakers /Cyrille Le Clerc Product Manager
SignalFx Platform: Security and Compliance MARZENA FULLER. Chief Security Officer
SignalFx Platform: Security and Compliance MARZENA FULLER Chief Security Officer SignalFx Platform: Security and Compliance INTRODUCTION COMPLIANCE PROGRAM GENERAL DATA PROTECTION DATA SECURITY Data types
CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR
PDF NESSUS VULNERABILITY SCANNER - BASICS - SECURITYLEARN CAMSCANNER TURN YOUR PHONE AND TABLET INTO SCANNER FOR 1 / 6 2 / 6 3 / 6 website vulnerability scanner pdf Basics vulnerability scanning with NESSUS...
F5 Synthesis Information Session. April, 2014
F5 Synthesis Information Session April, 2014 Agenda Welcome and Introduction to Customer Technology Challenges Software Defined Application Services Reference Architectures for Today s Customer Challenges
CLOUD WORKLOAD SECURITY
SOLUTION OVERVIEW CLOUD WORKLOAD SECURITY Bottom line: If you re in IT today, you re already in the cloud. As technology becomes an increasingly important element of business success, the adoption of highly
Application Security at DevOps Speed and Portfolio Scale. Jeff Contrast Security
Application Security at DevOps Speed and Portfolio Scale Jeff Williams @planetlevel Contrast Security OWASP XSS Prevention Cheat Sheet 1,000,000 Page Views! https://www.owasp.org/index.php/xss_(cross_site_scripting)_prevention_cheat_sheet
Security as Code: The Time is Now. Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS
Security as Code: The Time is Now Dave Shackleford Founder, Voodoo Security Sr. Instructor, SANS Introduction Business is moving faster to the cloud, and DevOps is accelerating scale and pushing automation
Web Application Firewall
Web Application Firewall Take chances with innovation, not security. HaltDos Web Application Firewall offers unmatched security capabilities, customization options and reporting analytics for the most
McAfee Network Security Platform 8.3
8.3.7.28-8.3.7.6 Manager-Virtual IPS Release Notes McAfee Network Security Platform 8.3 Revision B Contents About this release New features Enhancements Resolved issues Installation instructions Known
Web Application Penetration Testing
Web Application Penetration Testing COURSE BROCHURE & SYLLABUS Course Overview Web Application penetration Testing (WAPT) is the Security testing techniques for vulnerabilities or security holes in corporate
Integrated Web Application Firewall & Distributed Denial of Service (DDoS) Mitigation Solution
Integrated Web Application Firewall & Distributed Denial of Service (DDoS) Mitigation Solution (Layer 3/4 and Layer 7) Delivering best-in-class network and web application security to the modern enterprise
DDoS Hybrid Defender. SSL Orchestrator. Comprehensive DDoS protection, tightly-integrated on-premises and cloud
SSL Orchestrator DDoS Hybrid Defender All-in-one solution designed to deliver increased visibility into encrypted traffic Comprehensive DDoS protection, tightly-integrated on-premises and cloud Converts
TIBCO Cloud Integration Security Overview
TIBCO Cloud Integration Security Overview TIBCO Cloud Integration is secure, best-in-class Integration Platform as a Service (ipaas) software offered in a multi-tenant SaaS environment with centralized
Vulnerability Management
Vulnerability Management Modern Vulnerability Management The IT landscape today is changing and because of that, vulnerability management needs to change too. IT environments today are filled with both
OpenShift Roadmap Enterprise Kubernetes for Developers. Clayton Coleman, Architect, OpenShift
OpenShift Roadmap Enterprise Kubernetes for Developers Clayton Coleman, Architect, OpenShift What Is OpenShift? Application-centric Platform INFRASTRUCTURE APPLICATIONS Use containers for efficiency Hide
Put Security Into Your DevOps NOW. Or Prepare for the Flood Matthew Fisher Solution Architect, Fortify Federal 08MAR2018
Put Security Into Your DevOps NOW Or Prepare for the Flood Matthew Fisher Solution Architect, Fortify Federal 08MAR2018 Defining Devops State of Devops Report (Puppet, Dora):..set of practices and cultural
AWS Web Application Firewall. Darren Weiner Cloud Architect/Engineer
AWS Web Application Firewall Darren Weiner Cloud Architect/Engineer My journey 20 years in IT 8 years in the cloud Rode the.com wave Web Admin DBA IT Director Cloud Consulting Today s Journey Adoption
ForeScout Extended Module for IBM BigFix
ForeScout Extended Module for IBM BigFix Version 1.0.0 Table of Contents About this Integration... 4 Use Cases... 4 Additional BigFix Documentation... 4 About this Module... 4 Concepts, Components, Considerations...
Security Solution. Web Application
Web Application Security Solution Netsparker is a web application security solution that can be deployed on premise, on demand or a combination of both. Unlike other web application security scanners,
WEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM
SECURITY ANALYTICS WEBSCALE CONVERGED APPLICATION DELIVERY PLATFORM BLAZING PERFORMANCE, HIGH AVAILABILITY AND ROBUST SECURITY FOR YOUR CRITICAL WEB APPLICATIONS OVERVIEW Webscale is a converged multi-cloud
Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation
18 QUALYS SECURITY CONFERENCE 2018 Real-Time Vulnerability Management Operationalizing the VM process from detection to remediation Jimmy Graham Senior Director, Product Management, Qualys, Inc. Agenda
McAfee Web Gateway Administration
McAfee Web Gateway Administration Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction to the tasks crucial
Integrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises
Integrated Web Application Firewall (WAF) & Distributed Denial Of Service (DDoS) Mitigation For Today s Enterprises AI-driven website & network protection service that secures online businesses from today's
AGENDA. 13:30-14:25 Gestion des patches, du provisionning et de la configuration de RHEL avec Satellite 6.1, par Michael Lessard, Red Hat
AGENDA 13:30-14:25 Gestion des patches, du provisionning et de la configuration de RHEL avec Satellite 6.1, par Michael Lessard, Red Hat 14:25-14:35 Capsule : Surveiller les accès aux fichiers avec Auditd,
Monitoring Attack Surface and Integrating Security into DevOps Pipelines
Monitoring Attack Surface and Integrating Security into DevOps Pipelines Dan Cornell @danielcornell 0 Agenda Background Importance of Attack Surface What Does Attack Surface Have to Do with DevOps? Hybrid
Sunil Shah SECURE, FLEXIBLE CONTINUOUS DELIVERY PIPELINES WITH GITLAB AND DC/OS Mesosphere, Inc. All Rights Reserved.
Sunil Shah SECURE, FLEXIBLE CONTINUOUS DELIVERY PIPELINES WITH GITLAB AND DC/OS 1 Introduction MOBILE, SOCIAL & CLOUD ARE RAISING CUSTOMER EXPECTATIONS We need a way to deliver software so fast that our
WHITEHAT SECURITY. T.C. NIEDZIALKOWSKI Technical Evangelist. DECEMBER 2012
WHITEHAT SECURITY DECEMBER 2012 T.C. NIEDZIALKOWSKI Technical Evangelist tc@whitehatsec.com WhiteHat Security Company Overview Headquartered in Santa Clara, CA WhiteHat Sentinel SaaS end-to-end website
MODERN APPLICATION ARCHITECTURE DEMO. Wanja Pernath EMEA Partner Enablement Manager, Middleware & OpenShift
MODERN APPLICATION ARCHITECTURE DEMO Wanja Pernath EMEA Partner Enablement Manager, Middleware & OpenShift COOLSTORE APPLICATION COOLSTORE APPLICATION Online shop for selling products Web-based polyglot
McAfee Network Security Platform 8.3
8.3.7.28-8.3.3.9 Manager-Mxx30-series Release Notes McAfee Network Security Platform 8.3 Revision C Contents About this release New features Enhancements Resolved issues Installation instructions Known
Web Application Firewall
Web Application Firewall Getting Started Guide Version 2.5 November 15, 2017 Copyright 2014-2017 by Qualys, Inc. All Rights Reserved. Qualys and the Qualys logo are registered trademarks of Qualys, Inc.
Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
Unify DevOps and SecOps: Security Without Friction
SANS Secure DevOps Summit Unify DevOps and SecOps: Security Without Friction Matt Alderman, CISSP Chief Strategy & Marketing Officer Layered Insight @maldermania Technology Trend #1: Infrastructure Migrates
Integrigy Consulting Overview
Integrigy Consulting Overview Database and Application Security Assessment, Compliance, and Design Services March 2016 mission critical applications mission critical security About Integrigy ERP Applications
Qualys 8.7 Release Notes
Qualys 8.7 Release Notes This new release of the Qualys Cloud Suite of Security and Compliance Applications includes improvements to Vulnerability Management and Policy Compliance. Qualys Cloud Platform
Accelerate at DevOps Speed With Openshift v3. Alessandro Vozza & Samuel Terburg Red Hat
Accelerate at DevOps Speed With Openshift v3 Alessandro Vozza & Samuel Terburg Red Hat IT (R)Evolution Red Hat Brings It All Together What is Kubernetes Open source container cluster manager Inspired by
Chapter 5: Vulnerability Analysis
Chapter 5: Vulnerability Analysis Technology Brief Vulnerability analysis is a part of the scanning phase. In the Hacking cycle, vulnerability analysis is a major and important part. In this chapter, we
haltdos - Web Application Firewall
haltdos - DATASHEET Delivering best-in-class protection for modern enterprise Protect your website against OWASP top-10 & Zero-day vulnerabilities, DDoS attacks, and more... Complete Attack Protection
SOLUTION BRIEF. Enabling and Securing Digital Business in API Economy. Protect APIs Serving Business Critical Applications
Enabling and Securing Digital Business in Economy Protect s Serving Business Critical Applications 40 percent of the world s web applications will use an interface Most enterprises today rely on customers
Qualys Cloud Platform (VM, PC) v8.x Release Notes
Qualys Cloud Platform (VM, PC) v8.x Release Notes Version 8.16 December 14, 2018 This new release of the Qualys Cloud Platform (VM, PC) includes improvements to Vulnerability Management and Policy Compliance.
Version 2.38 April 18, 2019
Version 2.38 April 18, 2019 in Qualys Cloud Suite 2.38! AssetView Azure Instance State search token and Dynamic Tag Support Security Assessment Questionnaire New Search Option for Template Selection Web
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training
McAfee Web Gateway Administration Intel Security Education Services Administration Course Training The McAfee Web Gateway Administration course from Education Services provides an in-depth introduction
Exam : Implementing Microsoft Azure Infrastructure Solutions
Exam 70-533: Implementing Microsoft Azure Infrastructure Solutions Objective Domain Note: This document shows tracked changes that are effective as of January 18, 2018. Design and Implement Azure App Service
Qualys Cloud Platform (VM, PC) v8.x Release Notes
Qualys Cloud Platform (VM, PC) v8.x Release Notes Version 8.18 March 11, 2019 This new release of the Qualys Cloud Platform (VM, PC) includes improvements to Vulnerability Management and Policy Compliance.
SOLUTION BRIEF CA API MANAGEMENT. Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management
SOLUTION BRIEF CA API MANAGEMENT Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management 2 SOLUTION BRIEF ENABLE AND PROTECT YOUR WEB APPLICATIONS WITH CA API MANAGEMENT ca.com
Running MarkLogic in Containers (Both Docker and Kubernetes)
Running MarkLogic in Containers (Both Docker and Kubernetes) Emma Liu Product Manager, MarkLogic Vitaly Korolev Staff QA Engineer, MarkLogic @vitaly_korolev 4 June 2018 MARKLOGIC CORPORATION Source: http://turnoff.us/image/en/tech-adoption.png
1. APPLICATION SECURITY: KEY CHALLENGES
DATA SHEET PT APPLICATION FIREWALL DATA SHEET 1. APPLICATION SECURITY: KEY CHALLENGES Almost every modern enterprise uses hundreds of web, mobile or ERP applications to help run their operations. But as
Beyond Blind Defense: Gaining Insights from Proactive App Sec
Beyond Blind Defense: Gaining Insights from Proactive App Sec Speaker Rami Essaid CEO Distil Networks Blind Defense Means Trusting Half Your Web Traffic 46% of Web Traffic is Bots Source: Distil Networks