Why penetration testing tools don’t work as enterprise scanners

There’s a world of difference between a web vulnerability scanner and a full-fledged enterprise DAST solution. Taking a scanner intended for manual penetration testing and trying to use it on an enterprise scale is a common scenario that rarely ends well. This post looks into the biases behind such decisions and shows how to pick the right tool for the job.

Passwords vs. Pass Phrases – Weaknesses Beyond the Password

Using strong passwords is not enough, the whole system should be built well to ensure that the underlying technology can survive a data breach, when, and not if it happens. In fact a modernized approach to password ideology is only one of the several necessary steps for a highly-secured system

Why QA Pros Should Be More Involved in Web Security

This security post explains why QA team members can be a good fit to do web application security testing and vulnerability finding and why businesses should involve more QA team members in their web application security programs.

Passwords vs. Pass Phrases – An Ideological Divide

The concept of passwords is very old and the more efficient offline password crackers are becoming, the more difficult it is for users to come up with complex passwords. This whitepaper looks into how efficient complex passwords are and highlights other alternatives to complex passwords.

What Can We Learn from Ebay Hack Attack?

ebay just confirmed that one of its services has been hacked and malicious hackers managed to get their hands on a database that contain sensitive user information such as usernames and passwords. Could such attack have been avoided? This article explains what happened and highlights a number of web security best practices to avoid having your websites and web applications hacked.

Don’t Waste Your Testing Team’s Talents – Automate the Repetitive

Many companies shy away from automated testing: it cannot replace manual testing, they reason, and so why invest so much in it? This view can be defended for user interface testing, but it falls short of the reality of web security testing, or better web vulnerability scanning. Read more and learn how an automated web vulnerability scanner can help you get the best out of your web testing and security teams

Is Your Web Vulnerability Scanner Approved by PCI?

Is the web vulnerability scanner you are using approved by PCI? This article talks about PCI and PCI DSS and explains why automated software used in PCI DSS compliance audits, such as an automated web vulnerability scanner and web security scanner cannot be approved by PCI.

Complete beginner’s guide to web application security

Working in QA? Take your Web Application Security Testing to the Next Level

As a QA professional, you are in a perfect position to add much more value to the web application security testing and vulnerabilities detection processes. Read more and learn what you can do to improve your testing skills and start incorporating more complete web application security tests in your normal QA tests.

The Importance of Planning out Web Application Security Testing

This article explains how to plan a web application vulnerability detection program to ensure that all vulnerabilities in your business web applications are identified and closed. It also explains what are the basic building blocks for a successful web security assessment.

What Changed and What you need to know about PCI DSS 3.0

The new PCI DSS version 3.0 guidelines will take effect on the 1st of January 2014 but will only be forced in 2015. Still, 1 year passes by so quickly so read this document to see what changed and what is new in the new PCI DSS 3.0 guidelines and check how it might impact your business and the security of your websites and web applications.

Why You Should Run Authenticated Web Security Scans

Do you scan all sections of your web applications, including the authenticated sections? In this blog post you will find a number of reasons why you and every other web security expert and penetration testers should run authenticated web application security scans.

PCI Compliance – The Good, The Bad, and The Insecure – Part 2

In this second part of the compliance article, the author explains in detail how each and every category in the PCI DSS requirements should be dealt with to ensure that your websites, web applications and also business are operating securely. This is the definitive guide to PCI DSS compliance every business and organization should read.