Few are the organizations that truly recognize the importance of developing, deploying and maintaining secure applications as part of their effort to mitigate security risks. Most companies remain stuck in the past by not following security best practices and allowing common vulnerabilities such as Cross-site scripting (XSS), SQL injection, other security misconfigurations and known vulnerabilities to be left unchecked. To make matters worse, most companies do not use any sort of framework or compliance guideline to help them achieve their security goals throughout their software development lifecycle.
This is the precise reason that OWASP (Open Web Application Security Project) created the OWASP Top 10. The OWASP Top 10 has been constantly evolving since 2003, and is a simple classification of vulnerability classes aimed at defenders to help them easily understand common web application vulnerabilities and keep them out of their software both for the sake of security and compliance.
While the Top 10 is not in and of itself a compliance or regulatory standard, it is however, typically used either as an reference guide by other regulatory and compliance standards, or as a framework by organizations who need to comply with regulatory or compliance standards such as PCI DSS, HIPPA, ISO 27001 and others.
While knowing where to start could be overwhelming, setting policies and incentives based on eliminating OWASP Top 10 vulnerabilities is a great starting point — be it shoring up on injection attacks, broken authentication and session management or even reducing sensitive data exposure. This is where Acunetix can help.
Fast and flexible compliance
With application security risks evolving so quickly, the modern software security is full of complexities. As such, many legacy vulnerability scanners designed to scan websites built a decade ago, can’t properly scan large and complex web applications quickly and accurately without security experts on staff. With a re-engineered core, and a highly optimized crawler, every inch of Acunetix is tuned for speed, efficiency and accuracy, allowing it to find vulnerabilities even in the largest and most complex of applications without breaking a sweat.
What’s more, with Acunetix, it’s possible to throttle the speed at which a scan runs, ensuring that even high-traffic sites can be scanned without affecting their performance. You can also schedule compliance scans to run at specific times of a day, week or month, or even define you own custom schedule.
You also have the option of running scans on a continuous basis with Acunetix only running a quick scan every day of the week, with a full compliance scan run once a week. This ensures that any new vulnerabilities that may have been introduced in-between full scans get picked up by Acunetix immediately.
Beyond the OWASP Top 10
Another problem that Acunetix solves which many other external vulnerability scanners fall short of is the ability to produce great reports. While Acunetix can provide you with an OWASP Top 10 compliance report, it doesn’t stop there. In addition to OWASP Top 10 compliance reports, Acunetix can also instantly generate a wide variety of other technical and regulatory and compliance reports such as PCI DSS, NIST and many others. Additionally, Acunetix also allows users to export discovered vulnerabilities to Issue Trackers such as Atlassian JIRA, GitHub and Microsoft Team Foundation Server (TFS).
One of the biggest issues with conventional web vulnerability scanners is that they simply report a list of vulnerabilities after a scan is complete. Acunetix takes a different approach in that once a vulnerability is found during a scan, it is automatically cataloged and assigned a status of Open. After the vulnerability gets fixed, Acunetix may be used to re-test the vulnerability to make sure it’s properly fixed, and then automatically marks it as Closed.
All of this information is available at a glance in the Acunetix Dashboard and thanks to Acunetix’s multi-user, multi-role capabilities, security teams and other external security professionals can access exactly what they’re meant to.
Learn more about prominent vulnerabilities, keep up with recent product updates, and catch the latest news from Acunetix.
"We use Acunetix as part of our Security in the SDLC and to test code in DEV and SIT before being promoted to Production."Kurt Zanzi, Xerox CA-MMIS Information Securtiy Office, Xerox