東華大學圖書館 |

語系: 繁體中文

說明(常見問題)

回圖書館首頁

手機版館藏查詢

登入

回首頁

切換: 標籤 | MARC模式 | ISBD

Comparing Effectiveness and Efficien...

Seth, Aishwarya,

FindBook

Google Book

Amazon

博客來

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools /

紀錄類型:	書目-電子資源 : Monograph/item
正題名/作者:	Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools // Aishwarya Seth.
作者:	Seth, Aishwarya,
面頁冊數:	1 electronic resource (56 pages)
附註:	Source: Masters Abstracts International, Volume: 84-04.
Contained By:	Masters Abstracts International84-04.
標題:	Medical records. -
電子資源:	https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=29419972
ISBN:	9798352653821

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools /
Seth, Aishwarya,

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools /Aishwarya Seth. - 1 electronic resource (56 pages)

Source: Masters Abstracts International, Volume: 84-04.

Numerous studies, such as by Alomar et al. [2], substantiate that security teams often struggle to justify the costs of vulnerability detection and other vulnerability management activities. The need to improve vulnerability detection efforts while not expending unnecessary resources makes it crucial for practitioners to employ tools which optimize the resources and maximize efficiency. Practitioners can benefit from guidance in selecting vulnerability detection and prevention tools and techniques which are resource efficient and as per their need.An initial study comparing vulnerability detection techniques, such as Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) and manual penetration testing was published in 2011 and 2013 by Austin et al. [3; 4]. However, the sys1 tems in those studies were less than 5000,000 lines of code. In 2022, Elder et al. [1] compared four vulnerability detection techniques and tools on OpenMRS, an open source medical records system made up of almost four million lines of Java code. Their study found that exploratory manual penetration testing (EMPT) was the most efficient technique followed by the SAST tool. In terms of effectiveness, they found that a combination of techniques and tools was required to cover as many number and types of vulnerabilities as possible. Since these studies [3; 4; 1] have been conducted, additional classes of tools are emerging for vulnerability detection and prevention that have not been studied namely, Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools. IAST vulnerability detection tools have access to the source code and involve active real-time interaction with the application being tested for vulnerabilities. An agent of the tool is integrated in the server of the application so that the tool monitors all the requests, code and data flow within the application. [5] The source code of the application pertaining to those requests and data flow are scanned for vulnerabilities. So the code coverage is in accordance with how thoroughly the application is being used. Since IAST tools scan source code and also use test cases for detecting vulnerabilities, they are said to incorporate advantages of both SAST and DAST tools. [6]On the other hand, RASP tools try to detect and block attacks happening in real-time production environment. A RASP agent is integrated into the application at the time of deployment which has the capability to control the execution of the application [7]. When a malicious attempt is made to change the behaviour or state of the application, the RASP agent which has access to the source code, actively tries to detect and block the attack happening in real-time. Thus, RASP tools add another dimension of security to applications in the form of vulnerability exploitation prevention unlike other tools discussed in this paper which are used in the testing phase for vulnerability detection. We would like to add that RASP should not be confused with Web Application Firewall (WAF). RASP is configured 2 to be setup in the application during deployment and has access to the source code. RASP monitors both input, output and data flow to detect an attack and proceeds to block an attack in case one is detected.

English

ISBN: 9798352653821Subjects--Topical Terms:

927772
Medical records.

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools /
LDR:04768nmm a22004093i 4500 001 2430613
005 20250527055716.5
006 m o d
007 cr|nu||||||||
008 261011s2022 miu||||||m |||||||eng d
020 $a 9798352653821
035 $a (MiAaPQD)AAI29419972
035 $a (MiAaPQD)NCState_Univ18402039813
035 $a AAI29419972
040 $a MiAaPQD $b eng $c MiAaPQD $e rda
100 1 $a Seth, Aishwarya, $e author. $3 3819020
245 1 0 $a Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools / $c Aishwarya Seth.
264 1 $a Ann Arbor : $b ProQuest Dissertations & Theses, $c 2022
300 $a 1 electronic resource (56 pages)
336 $a text $b txt $2 rdacontent
337 $a computer $b c $2 rdamedia
338 $a online resource $b cr $2 rdacarrier
500 $a Source: Masters Abstracts International, Volume: 84-04.
500 $a Advisors: Reaves, Bradley; Enck, William; Williams, Laurie.
502 $b M.Sc. $c North Carolina State University $d 2022.
520 $a Numerous studies, such as by Alomar et al. [2], substantiate that security teams often struggle to justify the costs of vulnerability detection and other vulnerability management activities. The need to improve vulnerability detection efforts while not expending unnecessary resources makes it crucial for practitioners to employ tools which optimize the resources and maximize efficiency. Practitioners can benefit from guidance in selecting vulnerability detection and prevention tools and techniques which are resource efficient and as per their need.An initial study comparing vulnerability detection techniques, such as Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) and manual penetration testing was published in 2011 and 2013 by Austin et al. [3; 4]. However, the sys1 tems in those studies were less than 5000,000 lines of code. In 2022, Elder et al. [1] compared four vulnerability detection techniques and tools on OpenMRS, an open source medical records system made up of almost four million lines of Java code. Their study found that exploratory manual penetration testing (EMPT) was the most efficient technique followed by the SAST tool. In terms of effectiveness, they found that a combination of techniques and tools was required to cover as many number and types of vulnerabilities as possible. Since these studies [3; 4; 1] have been conducted, additional classes of tools are emerging for vulnerability detection and prevention that have not been studied namely, Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools. IAST vulnerability detection tools have access to the source code and involve active real-time interaction with the application being tested for vulnerabilities. An agent of the tool is integrated in the server of the application so that the tool monitors all the requests, code and data flow within the application. [5] The source code of the application pertaining to those requests and data flow are scanned for vulnerabilities. So the code coverage is in accordance with how thoroughly the application is being used. Since IAST tools scan source code and also use test cases for detecting vulnerabilities, they are said to incorporate advantages of both SAST and DAST tools. [6]On the other hand, RASP tools try to detect and block attacks happening in real-time production environment. A RASP agent is integrated into the application at the time of deployment which has the capability to control the execution of the application [7]. When a malicious attempt is made to change the behaviour or state of the application, the RASP agent which has access to the source code, actively tries to detect and block the attack happening in real-time. Thus, RASP tools add another dimension of security to applications in the form of vulnerability exploitation prevention unlike other tools discussed in this paper which are used in the testing phase for vulnerability detection. We would like to add that RASP should not be confused with Web Application Firewall (WAF). RASP is configured 2 to be setup in the application during deployment and has access to the source code. RASP monitors both input, output and data flow to detect an attack and proceeds to block an attack in case one is detected.
546 $a English
590 $a School code: 0155
650 4 $a Medical records. $3 927772
650 4 $a Software. $2 gtt. $3 619355
650 4 $a Access control. $3 1458437
650 4 $a Medical research. $2 bicssc $3 1556686
650 4 $a Computer science. $3 523869
690 $a 0984
690 $a 0769
690 $a 0454
710 2 $a North Carolina State University. $e degree granting institution. $3 3765716
720 1 $a Reaves, Bradley $e degree supervisor.
720 1 $a Enck, William $e degree supervisor.
720 1 $a Williams, Laurie $e degree supervisor.
773 0 $t Masters Abstracts International $g 84-04.
790 $a 0155
791 $a M.Sc.
792 $a 2022
856 4 0 $u https://pqdd.sinica.edu.tw/twdaoapp/servlet/advanced?query=29419972