Re: Web application security scanners

["Lovaas,Steven R" <Steven.Lovaas () COLOSTATE EDU>]

We're taking a serious look at Watchfire's AppScan...

Steve


==============================================
Steven Lovaas, MSIA, CISSP
Network Security Manager
Academic Computing & Network Services
Colorado State University
970-297-3707
Steven.Lovaas () ColoState EDU
============================================
-----Original Message-----
From: Brad Judy [mailto:Brad.Judy () COLORADO EDU]
Sent: Thursday, January 18, 2007 3:10 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Web application security scanners

We're starting to look into web application security scanning tools and I wanted to ping the group and see what people 
found when looking into this for themselves and what motivated their selection.

After some initial digging, it looks like most people lean towards Spidynamics' WebInspect or Watchfire's AppScan.  I 
plan on looking into both of those.

Obviously, none of these products are the end-all-be-all of web app security, but they do address the basic need of 
common web app coding errors for an initial level of validation of both in-house developed apps as well as pre-purchase 
testing of commercial apps.

So, what did you learn when looking into this space, what did you select and why?

Thanks,

Brad Judy

IT Security Office
Information Technology Services
University of Colorado at Boulder