To fully secure your web applications, you need several software solutions, specialist internal resources, and external contractors. However, this means significant costs, and not everyone can afford it all at once. How should small businesses start their web application security journey?
Let’s have a look at your options and the reasons why DAST is a clear winner as the starting point for web application security.
Web application security options
Many manufacturers of web security software advertise their products as the only thing you need to have your websites and web applications secured. This is obviously not true, and here are some key reasons why:
Web application firewalls (WAF) are advertised as the way to prevent web attacks; however, they can be circumvented by attackers, and they don’t resolve the problem (the application stays vulnerable). You may end up with an application full of holes behind a paper wall.
Software composition analyzers (SCA) are the best way to avoid vulnerable open-source software, but if you customize the open-source applications too much or if you write your own code, they won’t help you at all. You may end up having secure WordPress and your own application that is full of holes.
Runtime protection tools (RASP) are meant only to protect your application while it is running in production; until then, you have no idea whether it has any vulnerabilities. You may end up realizing that you have a problem while you’re actually being hacked.
White-box scanners (SAST tools) are advertised as being able to find the most vulnerabilities in your application; however, they require you to create the application from scratch or have its source code, they work for only some programming languages, and they report a lot of false positives. You may end up having to buy five of them, and your WordPress will still be full of holes.
Grey-box scanners (IAST tools) – like SAST tools, they are also meant for your own code, are available only for some programming languages, and, in most cases, are heavily dependent on the test suites.
Black-box scanners (DAST tools) – last but not least, DAST tools will not point you to the source of the error as effectively as a SAST/IAST tool, but they are by far the most universal and cost-effective solution.
Instead of purchasing software, you may, of course, hire professionals to perform manual analysis using free tools, or you may outsource your web security. However, in both cases, the efficiency of finding vulnerabilities and eliminating them as soon as possible will greatly suffer. While manual penetration testing will find more than any automated tool would, it takes a lot of time and is much more costly than a well-selected piece of software.
Here’s why we believe that your best option is to first go with a professional DAST tool and only later expand your toolset.
Reason 1. DAST tools are universal
Do you want to check the security of your own application? Or a third party application purchased from another company? Or a free application downloaded from the Internet? Do you want to check the application just before it goes into production? Or do you prefer to check it as it’s being developed?
Wherever your application comes from, whatever language it is written in, and at whichever stage of development it currently resides (as long as it can be run), a DAST tool will let you check it for vulnerabilities. This makes it the most universal tool on the market. All it needs is for your web application to be accessible via a browser.
No other tool can even begin to compare in terms of how universal they are. WAFs and RASP tools only work in production. SCA tools only work with open-source software. SAST tools only work if you have the source code. IAST tools only work for some languages.
Therefore, if you’re looking for a tool that you can use in any context, no matter how your company develops, DAST is the way to go. If you start with a third-party application and then switch to in-house development, DAST will still be there. If you start with scanning during staging and then want to implement DevSecOps, DAST will still be there.
An investment in DAST will never tie you to any kind of technology or internal company organization. You won’t get that kind of return on investment with any other solution.
Reason 2. DAST tools are the most thorough
To secure your websites and web applications, you need to make sure that all of them are secure and that every part of them is secure. Then, you need to eliminate the vulnerabilities that were found.
This is yet another area where DAST tools shine. They don’t just check your web application code. They also look at the environment that the web application runs in. For example, a DAST tool will not only help you pinpoint a vulnerability in the application itself but in the web server configuration, too. It will even tell you if you’re using a weak password. Again, no other tool can do all that at the same time.
You may have heard myths that DAST tools have problems with authenticated applications, but that’s simply not true at all unless you’re using amateur solutions. When we talk about DAST tools, we’re talking about tools like Acunetix, which were developed from scratch by companies devoted to web security.
There is, however, one major advantage when using SAST and IAST tools. They make remediation easier because they can point you to an error in the source code. Luckily, Acunetix comes with AcuSensor, which is an optional active IAST extension. As we mentioned before, it will only work with a few programming languages, but for these languages, you simply get a bonus in addition to all the advantages of DAST.
Reason 3. DAST tools are the most cost-effective
Investment in a professional DAST tool may seem major for a small business, but it pays off quickly because you can maintain a reasonably high level of web application security with just this one solution. On the other hand, if you invest in a different kind of tool, you get much less value for the money, and you are forced to re-invest every time your business goes through changes.
If you think that outsourcing your security will be more cost-effective, you may be in for an unpleasant surprise. While it does pay off to improve your security by hiring third parties to perform security audits, they give you absolutely no information about your everyday security stance. You probably wouldn’t feel safe running an antivirus scan every half a year, so why would it be acceptable to do the same for your business-critical web applications? The only viable option to outsource your web application security is by working together with an MSSP. However, not all MSSPs cover web application security, and those that do… use DAST tools for the purpose (usually Acunetix). So, in the end, it’s still the DAST tool that wins.
Another money-related advantage of DAST solutions is the lack of hidden costs. In the case of many other solutions, you end up facing additional expenses due to the necessity of hiring experts or training your teams. Acunetix can be run by general IT staff, not necessarily by dedicated security teams. Vulnerabilities pinpointed by Acunetix come with enough description for developers to be able to fix the problem without special training.
Conclusion: Start with Acunetix
If you feel convinced that DAST is the best way to begin your web application security journey, you may still feel confused about which product is the best option.
Luckily, there are less than ten professional DAST tools on the market, so there is not that much choice. Only a few of these products were developed by web application security experts – others are just add-ons to network scanners. Only a few of these products are actively developed and improved with the newest technologies. Only a few of these products focus on the ease of use and cost-effectiveness of scanning.
In the end, Acunetix clearly stands out from the crowd. Want proof? We’ll gladly show you. Simply ask for a demo.
Get the latest content on web security
in your inbox each week.
THE AUTHOR
Tomasz Andrzej Nidecki
Principal Cybersecurity Writer
LinkedIn
Tomasz Andrzej Nidecki (also known as tonid) is a Primary Cybersecurity Writer at Invicti, focusing on Acunetix. A journalist, translator, and technical writer with 25 years of IT experience, Tomasz has been the Managing Editor of the hakin9 IT Security magazine in its early years and used to run a major technical blog dedicated to email security.