Summer is in full swing, and that means soaring temperatures, backyard grill-outs, and the latest roundup of Q2 application security improvements from Rapid7. Yes, we know youve been waiting for this moment with more anticipation than Season 4 of Stranger Things. So lets start running up that hill, not beat around the bush (see what we did there?), and dive right in.
## OWASP Top 10 for application security
Way, way back in September of 2021 (it feels like it was yesterday), the Open Web Application Security Project (OWASP) released its [top 10 list of critical web application security risks](). Naturally, we were all over it, as OWASP is one of the most trusted voices in cybersecurity, and their Top 10 lists are excellent places to start understanding where and how threat actors could be coming for your applications. We released [a ton of material]() to help our customers better understand and implement the recommendations from OWASP.
This quarter, we were able to take those protections another big step forward by providing an [OWASP 2021 Attack Template and Report for InsightAppSec](). With this new feature, your security team can work closely with development teams to discover and remediate vulnerabilities in ways that jive with security best practice. It also helps to focus your AppSec program around the updated categories provided by OWASP (which we highly suggest you do).
The new attack template includes all the relevant attacks included in the updated OWASP Top 10 list which means you can focus on the most important vulnerabilities to remediate, rather than be overwhelmed by too many vulnerabilities and not focusing on the right ones. Once the vulns are discovered, [InsightAppSec]() helps your development team to remediate the issues in several different ways, including a new OWASP Top 10 report and the ability to let developers confirm vulnerabilities and fixes with Attack Replay.
## Scan engine and attack enhancements
Product support for OWASP 2021 wasnt the only improvement we made to our[ industry-leading DAST]() this quarter. In fact, weve been quite busy adding additional attack coverage and making scan engine improvements to increase coverage and accuracy for our customers. Here are just a few.
### Spring4Shell attacks and protections with InsightAppSec and tCell
We instituted a pair of improvements to InsightAppSec and [tCell]() meant to identify and block the now-infamous [Spring4Shell]() vulnerability. We now have included a default RCE attack module specifically to test for the Spring4Shell vulnerability with InsightAppSec. That feature is available to all InsightAppSec customers right now, and we highly recommend using it to prevent this major vulnerability from impacting your applications.
Additionally, for those customers leveraging tCell to protect their apps, we’ve added new detections and the ability to block Spring4Shell attacks against your web applications. In addition, we’ve added Spring4Shell coverage for our Runtime SCA capability. Check out [more here]() on both of these new enhancements.
### New out-of-band attack module
Weve added a new out-of-band SQL injection module similar to Log4Shell, except it leverages the DNS protocol, which is typically less restricted and used by the adversary. It’s included in the “All Attacks” attack template and can be added to any customer attack template.
### Improved scanning for session detection
We have made improvements to our scan engine on InsightAppSec to better detect unwanted logouts. When configuring authentication, the step-by-step instructions will guide you through configuring this process for your web applications.
## Making it easier for our customers
This wouldnt be a quarterly feature update if we didnt mention ways we are making InsightAppSec and tCell even easier and more efficient for our customers. In the last few months, we have moved the “Manage Columns” function into “Vulnerabilities” in InsightAppSec to make it even more customizable. You can now also hide columns, drag and drop them where you would like, and change the order in ways that meet your needs.
Weve also released an AWS AMI of the tCell nginx agent to make it easier for current customers to deploy tCell. This is perfect for those who are familiar with AWS and want to get up and running with tCell fast. Customers who also want a basic understanding of how tCell works and want to share tCells value with their dev teams will find this new AWS AMI to provide insight fast.
Summer may be a time to take it easy and enjoy the sunshine, but were going to be just as hard at work making improvements to InsightAppSec and tCell over the next three months as we were in the last three. With a break for a hot dog and some fireworks in there somewhere. Stay tuned for more from us and have a great summer.
_**Additional reading:**_
* _[Application Security in 2022: Where Are We Now?]()_
* _[API Security: Best Practices for a Changing Attack Surface]()_
* _[How to Secure App Development in the Cloud, With Tips From Gartner]()_
* _[Find, Fix, and Report ?OWASP Top 10 Vulnerabilities in InsightAppSec]()_
#### NEVER MISS A BLOG
Get the latest stories, expertise, and news about security today.
SubscribeRead More
References
Back to Main
