June 2021 Summaries

Acunetix and StackHawk are both Dynamic Application Security Testing (DAST) tools designed to identify and address common application security vulnerabilities, such as cross-site scripting (XSS) and SQL injection. Acunetix, established in 2005, focuses on testing production applications and is primarily used by security teams, offering both cloud-based and on-premise deployment models. It integrates with CI/CD systems but requires publicly accessible staging sites for testing, which can lead to longer scan times and delayed vulnerability fixes. StackHawk, on the other hand, is developer-centric and built for modern CI/CD automation, allowing for earlier testing in the development cycle without needing a publicly facing application. It utilizes the ZAP scanner and emphasizes API testing, providing real-time results and enabling developers to quickly address vulnerabilities. While Acunetix offers varying tiers with pricing based on the number of target sites, StackHawk's pricing is per user and includes full CI/CD integration across all tiers. The choice between the two depends on the organization's approach to application security, with StackHawk being more suited for DevSecOps practices and Acunetix aligning with traditional security team workflows.

Single page applications (SPAs) are increasingly popular due to their dynamic nature and improved user experience, but they introduce unique security challenges that traditional testing methods struggle to address. Unlike conventional web applications, SPAs rely on a changing document object model (DOM) and javascript execution, which complicates the use of HTML spiders for security testing since these tools miss dynamic elements. While ajax spiders offer a partial solution by better handling the dynamic nature of SPAs, they are often too slow and incomplete for modern development practices. To effectively test SPAs for vulnerabilities, companies should focus on the underlying APIs, as these remain consistent despite front-end changes. The process involves selecting a suitable security tool, configuring it for API testing, conducting scans, and automating security testing within continuous integration and deployment pipelines. This approach ensures most vulnerabilities are identified early and efficiently, helping teams maintain secure applications without accruing security-related technical debt.

WhiteHat, once a leading application security platform known for its dynamic (DAST), static (SAST), and software composition analysis (SCA) testing, is losing traction as modern software development practices evolve. The shift towards Agile, DevOps, and DevSecOps has necessitated faster, automated security tools integrated into CI/CD pipelines, which WhiteHat struggles to provide. As a result, newer developer-centric solutions like StackHawk for DAST, GitHub's CodeQL, and Snyk for SAST, and Snyk Open Source for SCA have emerged, offering more efficient, integrated, and developer-friendly alternatives. These modern tools enable real-time vulnerability detection and resolution, aligning with the rapid pace of today's software development environments and reducing inefficiencies associated with legacy security models. Despite the challenges of transitioning to these new tools, especially given the longstanding reliance on traditional security methods, companies are encouraged to explore these innovative solutions to shift application security left and enhance their development workflows.

Choosing between application security testing tools like Netsparker and StackHawk can be challenging due to their distinct approaches to security testing. StackHawk is designed for integration into continuous integration/continuous deployment (CI/CD) pipelines, enabling developers to quickly identify and rectify security vulnerabilities during the development process. This tool supports a developer-first workflow, allowing developers to triage and fix issues with immediate context, which can lead to increased efficiency and quicker resolution of vulnerabilities. In contrast, Netsparker is more suited for periodic scans of production applications, with vulnerabilities being reviewed and managed by security teams before being integrated into the broader engineering workflow. This approach can result in vulnerabilities being exposed for longer periods, but it allows security teams to maintain control over the triage process. The choice between these tools largely depends on an organization's security and engineering culture, with StackHawk favoring teams that embrace DevSecOps and developer empowerment, while Netsparker aligns with traditional security team-led processes.

Cross-Origin Resource Sharing (CORS) is a security feature implemented in modern browsers to prevent unauthorized cross-domain requests, which could otherwise be exploited in attacks such as Cross-Site Request Forgery (CSRF). Initially proposed in the early 2000s, CORS requires that a server explicitly permit requests from a different origin, defined by the combination of protocol, domain, and port. This mechanism allows legitimate cross-domain interactions, such as accessing APIs from a different subdomain or third-party services, while preventing malicious activities. In the Spring Framework, CORS can be configured at the method, class, or global level with specific annotations to allow requests from certain origins, while Spring Security requires additional configuration to bypass its default blocking of preflight requests. By strategically enabling CORS, developers can create more responsive applications without compromising security. This article was authored by Alexander Fridman, a seasoned software industry professional with over 11 years of experience, specializing in backend development.

Building websites without considering security can lead to vulnerabilities such as cross-site request forgery (CSRF), a common attack where malicious sites exploit a user's credentials to perform unauthorized actions on trusted sites. In Django, a popular web framework, CSRF protection is implemented through middleware, which is activated by default in the settings.py file. Developers can enhance security by using Django's CSRF middleware, template tags, and decorators to ensure that forms are protected against such attacks. For projects involving Django REST and front-end frameworks like React, developers must manually handle CSRF tokens by retrieving them from cookies and including them in form submissions and fetch requests. Understanding and enabling CSRF protection in web applications is crucial for safeguarding both the application and its users from security threats.