One of the products of HCL Software is a package of application security testing systems called AppScan. These systems implement testing services integrated into a CI/CD pipeline and are ideal for DevOps businesses.
Web applications are vulnerable to several hacker attacks. Although there have been many waves of hacker attack campaigns, they usually operate along the same lines, trying tricks like SQL injection methods to get in between modules as they call each other. Although the list of typical hacks is relatively short, they can be applied very infinitely, and application designers and programmers often fail to avoid these pitfalls. HCL AppScan looks for them.
About HCL Technologies
HCL Technologies is an Indian multinational that has development and sales offices worldwide, including in the UK and the USA. The company has developed many products and acquired more by buying other companies or receiving the catalogs of software developers.
The origins of the enterprise go back to 1976, and its full name is Hindustan Computers Limited. The parent company is called HCL Enterprise, and it split up in 1991, making its R&D department an independent company called HCL Technologies. The business is based in Noida, Uttar Pradesh, India.
One of HCL’s major acquisitions was a large slice of IBM’s product catalog, which brought AppScan to the company. AppScan has a long history since it was created by the Israeli software developer Sanctum Ltd in 1998. Sanctum was bought by Massachusetts-based Watchfire in 2004, bringing its base to the USA. Watchfire became the Rational Software division of IBM in 2007.
IBM added on a code analysis edition of AppScan in 2009 with the acquisition of Ounce Labs. HCL bought the AppScan system in June 2019.
Why use application security testing?
Application security testing is aimed at both the developers of Web applications and the businesses that support them. This service has become more essential to software development as industries developed the Software-as-a-Service delivery model.
Many software products are not complete, user-facing products. Instead, they provide valuable services to other software developments, either providing functions that can be plugged into end products or service managers, such as database systems.
Platforms, frameworks, APIs, and plug-ins speed up software development. However, as they can now be hosted by their creators and charged for as a metered service or on a subscription, the developers that use those functions have no control over how or where they run. As a result, they are black-box services and could contain security weaknesses.
So, the developers of websites, mobile apps, and Web applications have a lot of security risks to deal with. They need to check that their creations don’t have security flaws, and they also need to check that the components with which they build their systems don’t have flaws. One further factor in ensuring is that security services don’t create weaknesses when used with the newly developed application – two secure applications can unexpectedly create weaknesses when run together because of interdependency factors.
What is application security testing?
Businesses that develop software have the luxury of accessing its code. These applications are easy to test because automated application security testing systems know what coding errors to look for.
Scanning through code for security weaknesses is called static application security testing (SAST). Software development teams usually use systems that perform this type of test to verify code whenever it is stored in the project repository.
The users of Web applications don’t always get access to the code or even know where the application is run. In this scenario, the only testing method available involves running the software with specific inputs and checking the results. This is called dynamic application security testing (DAST), a type of vulnerability scanner.
If a SAST scan has verified code, it can be declared to be error-free, and it does not contain security weaknesses. However, some businesses will need to perform both SAST and DAST tests. This is because the finished product will combine in-house development and supporting third-party modules. Systems that perform both SAST and DAST tests are interactive application security testing (IAST) systems.
Even where third-party services are employed, the source code might be available in some cases. This is particularly the case with open-source applications. In these cases, the component will have been verified for security hardness before being released for general use. The open-source project regularly releases updates to remove newly discovered weaknesses, just like the producers of software packages.
Some application security testing systems check through for open-source components and then look to see whether there is a newer version available. This is a type of code-level patch management, and it is called software composition analysis (SCA).
HCL AppScan
HCL AppScan implements DAST, SAST, and IAST in its products. The DAST service is the original AppScan package first developed by Sanctum. The SAST system was developed by Ounce Labs and added on later. The IAST package combines the DAST and SAST systems in the AppScan service’s library. The four packages offered by AppScan are:
AppScan Source
AppScan Source is a SAST package that runs on Windows Server. This tool scans code for security errors and uses AI-based processes to automatically spot combinations of coding strategies that can create a security loophole. The machine learning system is called Intelligence Finding Analytics (IFA).
The tool runs on-premises and can be accessed as a standalone package or integrated into development environments as a plug-in. This system also includes source code analysis to identify open-source components in supporting APIs.
AppScan Standard
AppScan Standard is a DAST package that runs on-site. This is the original AppScan system. This system acts as a vulnerability scanner. It runs the module and attempts a series of hacker attempts. The system has its list of weaknesses to probe, but the OWASP Top 10 vulnerabilities are included.
As this is an automated system that doesn’t require access to code, it can be used to assess new services. This can include a check on supporting APIs that a development team intends to use, or it can be an acceptance testing tool for IT Operations departments considering buying a Web-based software package. DevOps teams would use it in both of these circumstances.
The AppScan Standard service can be set to run continuously. That is a valuable tool for IT Operations to check whether updates to supplied software have made security changes. The tool can also be integrated into a CI/CD pipeline to verify new functions before they go live.
If AppScan detects a vulnerability, its scan results include a recommendation on fixing the problem. For example, the solution could be a requirement to rewrite the code or a guide on altering system settings to remove the security weakness.
Test runs can be customized to provide specific use case scenarios. This can be useful for testing user features in websites and mobile apps.
AppScan Enterprise
AppScan Enterprise delivers both AppScan Source and AppScan Standard. This provides both SAST and DAST services; it is an IAST package. This is an on-premises system, so you host it on your servers. However, it doesn’t need to be kept as a separate system. The tool is also delivered as a REST API, making it easy to integrate the test cycle into a CI/CD pipeline.
AppScan on Cloud
AppScan on Cloud is the same package offered by AppScan Enterprise, but it is delivered from the Cloud, so you don’t need to host the software on your servers.
A SaaS version of AppScan Enterprise is available, which is called AppScan On Cloud.
HCL AppScan deployment options
- AppScan Source Installs on Windows Server
- AppScan Standard Installs on Windows Server
- AppScan Enterprise Installs on Windows Server
- AppScan On Cloud Delivered as a hosted SaaS package
HCL AppScan prices
HCL doesn’t publish its price list, so you need to start your buyer’s journey by requesting a demo or a free trial.
- AppScan Standard is available for a 30-day free trial.
- AppScan on Cloud is available for a 30-day free trial.
- AppScan Source can be viewed on a demo.
- AppScan Enterprise is also available for a demo.
You can also contact the HCL Sales Department to request a quote.
HCL AppScan strengths and weaknesses
HCL AppScan is offered in three formats: SAST, DAST, and IAST. The DAST service, and therefore the IAST system., is helpful for businesses that require accreditation for data privacy standards, such as PCI DSS and HIPAA. The SAST system will speed up development projects by catching errors quickly. We have identified some good and bad points about HCL AppScan.
Pros:
- A good compliment of SAST and DAST system from one provider
- The option to include custom use case scenarios
- Fix recommendations
- Compliance reporting
Cons:
- No cloud option for SAST-only or DAST-only packages
Alternatives to HCL AppScan
HCL AppScan is a competent application security testing platform and provides code scanning checks and assessments of running software. However, this isn’t the only package available on the market, and you should assess several candidates when buying new software and systems.
Here is our list of the best alternatives to HCL AppScan:
- Netsparker This DAST package includes a discovery service that will trace all of your web assets to enable them to be scanned for security weaknesses. The service can also be used as a straightforward vulnerability scanner. Module checks include AI reasoning, which can be integrated into development workflows. The reporting features of the tool provide material for compliance proof for HIPAA and PCI DSS. The package includes IAST strategies but no standalone SAST service. The system is available as a cloud service and for installation on Windows Server.
- Acunetix This DAST tool can be used as a vulnerability scanner or CI/CD pipeline tester. The product leans more towards automated testing of developed applications because it doesn’t have a standalone SAST system to scan through code under development. However, when the system discovers non-compiled modules, such as those written in JavaScript or PHP, it will browse through the code. The system also includes SCA. The software runs on Windows, macOS, and Linux and is also offered cloud service.
- GitLab Ultimate This is primarily an SDLC package that includes source code management. In its highest plan, the package offers a DAST service. This tool is designed for use by development teams rather than IT Operations technicians. Scan results include fixing recommendations. The service can be installed on Linux or accessed as a SaaS package. Assess the system with a 30-day free trial.
- AppCheck This SaaS package offers automated application security testing for integration into development workflows. The module can interface with Jira and Team City to cycle back failed code for rework, noting what needs to be fixed. The strategy at the heart of AppCheck is an IAST service that includes both DAST and SAST methods. The company also offers the services of human penetration testers. Try a free scan to assess the system.
- Checkmarx The cloud platform of testing services, offers separate plans for SAST and DAST. However, you can subscribe to both packages to get an IAST service. This is a good option for development teams because both services can be integrated into CI/CD pipelines. In addition, that DAST service also includes SCA and scans for the OWASP Top 10.
- Veracode This is a cloud-based platform with a list of plans that includes a SAST system and a DAST package. Both services will integrate into development lifecycles, and IT Operations can use the DAST package as a vulnerability scanner. Veracode also offers a penetration testing service.
