topic OWASP / Any WAS scan frequency in Tech Talk

OWASP / Any WAS scan frequency

Deyan — Wed, 14 Mar 2018 09:25:13 GMT

Hey ISC members,

What do you think should be the frequency of a web application security scanning such as OWASP scan? I am asking as the OWASP (and most of the web app flaws for that matter) are related to the code of the app and if once the OWASP list for example is covered - is it worth to run another scan in a month for example having in mind that the application code is not changed since the last OWASP scan? What are your thoughts around WAS scanning frequency and why?

Re: OWASP / Any WAS scan frequency

mmarlow — Wed, 14 Mar 2018 14:08:09 GMT

Disclaimer: I have passed the exam, but not been endorsed for CISSP.

Assuming you have no contractual or compliance obligations that would mandate otherwise:

I would recommend at a minimum that you perform a vulnerability scan on updated/integrated code before releasing any update to production or any time your vulnerability scanner is updated to discover new vulnerabilities.
Each web developer should scan their changes before committing them.
Absolute worst case: Vulnerability scan one a year.

Don't forget to scan legacy apps that are still accessible.

Re: OWASP / Any WAS scan frequency

canLG0501 — Thu, 15 Mar 2018 03:25:29 GMT

Most regard OWASP as a great reference point for web application security programs and education for IT Operations. Certain shops scan quarterly or bi-monthly and educate on the importance of code review standard operating procedures. The maturity of the security program may dictate the scan frequency and also being able to allow developers a vehicle similar to where they handle versioning control to provide feedback to Information Security Teams during remediation.