AppCheck – Vulnerability Scanning Platform

What is a Vulnerability Scanner?

• A vulnerability scanner is a computer program designed to assess computers, networks or applications for known weaknesses such as cross-site scripting, SQL injection and more.
• A vulnerability scanner uses a database that contains all the information required to check a system for security holes, then the scanner will try to exploit each vulnerability that is discovered and produce a report. This process is sometimes called ethical hacking.

Why Choose AppCheck?

• AppCheck is an automated online vulnerability scanner built and developed by leading penetration testers.
• Designed to run in the background searching for security flaws within your websites, applications, network and cloud infrastructure on a set schedule, whether that be out of business hours or continuously.
• Deployed as single SaaS scanning system or as part of a distributed scanning network, Appcheck offers unparalleled detection rates, accuracy and scalability.

Who is AppCheck?

• AppCheck is a UK-based software security vendor offering innovative scanning technology.
• Built from the ground up by experienced penetration testers, AppCheck’s aim is to bridge the gap between manual and automated testing tools, giving constant visibility with professional penetration test style reports.
• Not only does AppCheck detect vulnerabilities with known signatures, they detect some of the hardest to reach security flaws using a first principles methodology setting them apart from other vendors and resulting is being trusted by some of the worlds most recognised brands.
• All licences come with unlimited users meaning multiple departments can run scans against a variety of environments such as live, UAT and SDLC enabling AppCheck software to discover vulnerabilities 24/7 across your whole business.
• Offering several UK-based support services tailored to organisations of different sizes and technical understanding, AppCheck really excels at customer service, with access to remediation advice from experienced penetration testers.

Features:

• Automatic vulnerability management
• Easy to use vulnerability management dashboard
• Technology agnostic
• Self-configure tailored scans that fit your business with ease
• Scheduled scans for continuous or out of hours scanning
• Simple one-click reporting
• Safe exploitation of vulnerabilities
• Easy remediation advice for discovered vulnerabilities
• Flexible configuration and integrations with common development tools
• Conduct tests throughout the development lifecycle
• Ability to identify zero day vulnerabilities

Benefits:

• Scans test for OWASP Top 10 vulnerabilities as standard
• Unlimited users means multiple stakeholders can view and manage vulnerabilities
• Unlimited scanning frequency means vulnerabilities are discovered sooner
• Reports contain high-level overview and technical breakdown of vulnerabilities to cater to all audiences
• Detailed remediation advice helps quickly understand the vulnerability and potential impacts
• Ability to navigate complex workflows through multi-stage authentication and replicate user journeys
• Cost-effective

Vulnerability Scanning Statistics:

• 56% of breaches took months or longer to discover – to validate the use of an automated tool
• 71% of attacks were financially motivated – use this to validate the cost of the software licence
• Since 2015, web application breaches are now 13x more likely to occur

OWASP Top10

There are three new categories, four categories with naming and scoping changes, and some consolidation in the Top 10 for 2021.

• A01:2021-Broken Access Control moves up from the fifth position; 94% of applications were tested for some form of broken access control. The 34 Common Weakness Enumerations (CWEs) mapped to Broken Access Control had more occurrences in applications than any other category.
• A02:2021-Cryptographic Failures shifts up one position to #2, previously known as Sensitive Data Exposure, which was broad symptom rather than a root cause. The renewed focus here is on failures related to cryptography which often leads to sensitive data exposure or system compromise.
• A03:2021-Injection slides down to the third position. 94% of the applications were tested for some form of injection, and the 33 CWEs mapped into this category have the second most occurrences in applications. Cross-site Scripting is now part of this category in this edition.
• A04:2021-Insecure Design is a new category for 2021, with a focus on risks related to design flaws. If we genuinely want to “move left” as an industry, it calls for more use of threat modeling, secure design patterns and principles, and reference architectures.
• A05:2021-Security Misconfiguration moves up from #6 in the previous edition; 90% of applications were tested for some form of misconfiguration. With more shifts into highly configurable software, it’s not surprising to see this category move up. The former category for XML External Entities (XXE) is now part of this category.
• A06:2021-Vulnerable and Outdated Components was previously titled Using Components with Known Vulnerabilities and is #2 in the Top 10 community survey, but also had enough data to make the Top 10 via data analysis. This category moves up from #9 in 2017 and is a known issue that we struggle to test and assess risk. It is the only category not to have any Common Vulnerability and Exposures (CVEs) mapped to the included CWEs, so a default exploit and impact weights of 5.0 are factored into their scores.
• A07:2021-Identification and Authentication Failures was previously Broken Authentication and is sliding down from the second position, and now includes CWEs that are more related to identification failures. This category is still an integral part of the Top 10, but the increased availability of standardized frameworks seems to be helping.
• A08:2021-Software and Data Integrity Failures is a new category for 2021, focusing on making assumptions related to software updates, critical data, and CI/CD pipelines without verifying integrity. One of the highest weighted impacts from Common Vulnerability and Exposures/Common Vulnerability Scoring System (CVE/CVSS) data mapped to the 10 CWEs in this category. Insecure Deserialization from 2017 is now a part of this larger category.
• A09:2021-Security Logging and Monitoring Failures was previously Insufficient Logging & Monitoring and is added from the industry survey (#3), moving up from #10 previously. This category is expanded to include more types of failures, is challenging to test for, and isn’t well represented in the CVE/CVSS data. However, failures in this category can directly impact visibility, incident alerting, and forensics.
• A10:2021-Server-Side Request Forgery is added from the Top 10 community survey (#1). The data shows a relatively low incidence rate with above average testing coverage, along with above-average ratings for Exploit and Impact potential. This category represents the scenario where the security community members are telling us this is important, even though it’s not illustrated in the data at this time.

Source