Wider Application Security Coverage with HCL AppScan DAST and Vulnerable Third-Party Component Detection

According to The Linux Foundation Research, 70-90% of application code being used in modern-day applications is dependent on third-party libraries. This software supply chain dependency is a direct result of the demanding pace of modern development. It is far more efficient to incorporate “off the shelf” code for certain types of functionalities than it is to create these components from scratch.

But there is a security downside to all this reliance on third-party libraries. While the propriety code your team builds from scratch may have no vulnerabilities, it does not mean your application is secure if the external applications or components in the supply chain are vulnerable.

The dependent vulnerable components provide an opportunity for attackers, which, when undetected, can have a serious impact on your application and your business.

HCL AppScan DAST with Vulnerable Third-Party Component Detection

HCL AppScan DAST (dynamic application security testing) is an industry-leading technology that scans your applications and APIs against potential vulnerabilities. HCL AppScan DAST helps you prevent expensive web application security breaches by executing automated scans, assessing risks and helping you mitigate them before deployment.

One of the key strengths of the HCL AppScan DAST engine is in its ability to leverage a rich database of vulnerabilities. The database has been trained for over 30+ years while serving clients across the globe, analyzing their application behavior and providing valuable insights into the security posture of the application.

Now HCL AppScan introduces Vulnerable Third-Party Component Detection. This new capability augments the existing DAST capabilities by fingerprinting the most-used client and server-side technologies and reporting their vulnerabilities.

Snapshot from AppScan Standard highlighting the “Report vulnerable components” scan configuration.

Vulnerable Third-Party Component Detection Provides Numerous Benefits
 

• Comprehensive Vulnerability Coverage
  
  Hackers target well-known vulnerabilities in popular libraries. DAST together with Vulnerable Third-Party Component Detection provide you with much more comprehensive vulnerability coverage, allowing you to identify libraries with known vulnerabilities and see those findings alongside all your DAST results.

Snapshot from HCL AppScan Enterprise showing components detected on an application.

• Vulnerability Mitigation
  
  Tracking each vulnerability independently allows your security team to be more proactive when it comes to remediation. This focus and visibility also help mitigate the risks of potential future attacks targeting the same vulnerabilities. Teams can allocate resources for prioritized vulnerabilities, reducing the attack surface & maintaining a strong security posture.

Snapshot from AppScan Enterprise showing vulnerabilities in the identified third-party components.

• Compliance & Auditing

   

   

  DAST & Vulnerability Third-Party Component Detection helps your organization to identify & address non-complaint components, ensuring the necessary regulatory compliance requirements are met.

• Developer Awareness

   

   

  This added attention to third-party components promotes a culture of proactive security and encourages development team to regularly monitor & update software dependencies.

• Release Scope

   

   

  AppScan Standard 10.3.0 and AppScan Enterprise 10.3.0 release onwards.

AppScan on Cloud (SaaS offering)

With so many third-party components being incorporated into applications today, it is critical to know whether they are introducing vulnerabilities to your code base and/or undermining all your hard work to stay secure.

HCL AppScan DAST continues to provide industry-leading functional testing of applications. Now with the addition of fingerprinting vulnerable third-party components, development teams can see all these aggregated findings in centralized views for easier triage and remediation, significantly improving their overall software supply chain security.

Visit hcl-software.com/appscan for more information on HCL AppScan DAST with Vulnerable Third-Party Component Detection.