...
Using application security self-scanning to find and fix vulnerabilities will help to ensure that applications are less susceptible vulnerable to many common attacks. Please note that AppScan can potentially be dangerous if used on production sites and should only be targeted at test or development environments. Make sure to notify anyone who may be using or modifying the application that the scan will be occurring because AppScan may render the site unavailable. If your application is running What follows is a guide to using IBM's Rational AppScan.
What is AppScan?
IBM's Rational AppScan is an application penetration testing tool used by developers to test the security of their web applications while under development and before deployment. AppScan can also be used to scan applications which are already deployed but may not target the live production environment. AppScan will spider and crawl any application that it is pointed at. It will then execute about 5,000 canned security tests against every page that it finds. This tool is a " badness-ometer". It will not tell you if your application is good. It will simply tell you if you have really deep security troubles. Developers should still review for accessible sensitive information and other potential holes in an application after running a scan.
AppScan is a " badness-ometer". After running a scan, you should still test for other potential security issues, such as potential exposure of sensitive information and authentication and access control restrictions.
Who should use AppScan? When should scans be run?
Application security self scanning is a tool for developers who would like to test the security of their new sites. Information Security offers AppScan as an application penetration testing tool for this purpose. The earlier that AppScan is run in the development process, the easier it will be to fix the security flaws that it finds. You can run AppScan as frequently as you would like, and developers should consider running AppScan at least as soon as they have a working site and again before release. The University only has one AppScan license so only one scan can be run at a time. If someone else is scanning when you start, your scan will fail to launchFor this reason, please notify Information Security before running a scan so that they can confirm it will not conflict with any other scheduled scans. Developers may not yet have access to AppScan. Information Security can add your name or your group's name to the list of AppScan registered users. All scans run from one virtual machine which can be accessed via remote desktop launched on any Tufts computer once access is granted. Scans can take anywhere from a few hours to a few days depending on the size of the application they are scanning. It is recommended that you start a scan at the end of a workday. Most scans will finish overnight and the results can be reviewed the following day. Information Security is available to help interpret the results of scans and can also offer offerconsulting on the security of your application. Contact Information Security for more information or to set up a time to review scan results.
...