ESG Report Validates How HCL AppScan Helps Developers to Continuously Secure Applications

Introduction

In a recent Technical Review of HCL AppScan, analyst firm Enterprise Strategy Group (ESG) evaluated and analyzed how AppScan helps developers to continuously secure applications. ESG also evaluated how AppScan can easily be integrated into CI/CD pipelines and support DevSecOps initiatives, to provide organizations with continuous application security at scale.  

ESG’s Methodology 

To thoroughly evaluate AppScan’s application security testing capabilities, ESG followed the general steps that are outlined below: 

1. ESG defined and associated security policies with an application, using HCL AppScan on Cloud’s user interface.  
2. Then, ESG associated security policies with the application.  
3. Next, ESG evaluated AppScan’s “scan and analyze” capabilities, by integrating AppScan into a DevSecOps toolchain.  
4. After evaluating AppScan’s “scan and analyze” capabilities, ESG created a manual dynamic scan and reviewed scan results using the AppScan console.  
5. Finally, ESG evaluated AppScan’s reporting capabilities.  

AppScan’s Impact on DevSecOps  

ESG found that AppScan integrated into four main aspects of DevSecOps: 

• Policy definition, where security and regulatory professionals define and associate policies with an application.  
• Scan and analyze, when developers use static analysis to “shift security left,” so that they can identify vulnerabilities in code early in their CI/CD pipelines. Dynamic and interactive testing similarly help developers to identify vulnerabilities in running applications.  
• Vulnerability Remediation, the process that permits developers to review and fix vulnerabilities. ESG found that AppScan’s machine learning accelerated remediation by grouping and prioritizing related vulnerabilities and by identifying potential fixes and fix locations in source code.  
• Reporting, a key component of the DevSecOps process, where security and regulatory professionals and organizational management can continuously monitor their security and compliance progress.  

You can review all of ESG’s key findings- including benefits that you can achieve by incorporating AppScan into a DevSecOps model- by downloading the complimentary report now.  

Why Application Security Matters to You  

In the closing “Why This Matters” section of its report, ESG summarized the benefits of an effective Application Security Testing program, which I’ve captured verbatim below:  

“Integrating and automating application security testing into the DevSecOps methodology enables the identification and correction of cybersecurity vulnerabilities earlier in the application development lifecycle, which enhances security and increases efficiency. It also helps to alleviate challenges faced by skilled cybersecurity teams, which are often much smaller than development teams, as they try to keep up with the increasing pace DevSecOps demands. 

ESG validated that HCL AppScan simplified and accelerated application security testing. With just a few clicks, ESG defined security policies and configured AppScan to test our application for a set of security vulnerabilities and compliance with benchmarks and regulations. ESG found configuring and running on-demand scans to be just as quick and easy, and results from static and dynamic analysis were presented quickly in a concise and consistent interface.” 

To Learn More

In addition to downloading ESG’s complete report, you can watch my companion video with ESG analyst Dave Gruber, where Dave and I spotlight the elements of a truly state-of-the-art Application Security Testing solution.