Optimizing Security Scan for Speed and Accuracy

Introducing StackHawk’s new Optimization Tips Panel

First of all, welcome back to the PM corner, I’m Lindsy Farina, senior PM here at StackHawk! If you read my previous article about the themes we saw at RSA this year , you’d know that DAST and shifting left are super “on-trend” for 2023 security teams. In this blog post, we will explore StackHawk’s new Optimization Panel that houses tips to enhance the speed and accuracy of your DAST scans, the core elements of kickstarting your shift-left journey. So, grab your team, and let’s dive in!

What’s an Optimization Panel and why do I need it?

Great question! If you are like a lot of customers, you created a couple of applications during your POV with the help of my wonderful colleagues here at StackHawk, but maybe don’t remember all of the configuration tricks they used to help you get those scans going. Since you aren’t creating new applications every day, we know that it is easy to forget a few things, but we are here to help!

The new Optimization panel highlights the enablement status of three key features, custom scan discovery , technology flags , and authentication , on every scan, thus ensuring you don’t miss a step for your newly created applications. It will also tell you if something changes and configuration was lost, so you always have the latest information about the current state of your scans.

What can I expect to see in StackHawk?

For customers on our Pro and Enterprise plans, you should now see the Optimization Tips panel on the right side of the scan details page for each scan. You will also see the same icon from the panel on your environment cards on the Applications page.

Configuration is Queen

While there are quite a few dials you can turn in your StackHawk configuration, we will focus on the three I mentioned above. Please note that while you may have enabled these features, it may take a few rounds of testing to ensure that the configuration is just right! Don’t be discouraged, and don’t forget to invite your teams to help you on the journey!

Scope the scan with Custom Scan Discovery

One of the primary steps in optimizing a DAST scan is to define the scope. With Custom Scan Discovery, you can take advantage of other dev tools to help the scanner discover all the paths of your application. StackHawk allows you to do this by passing traffic generated from your existing dev tools like a Postman collection, or Selenium, Cypress, and Playwright test suites.

Tune your tech and plugins

• With StackHawk’s Technology Flags , you can tune HawkScan for the specific technologies in your application, such as database engines and software languages. By default, all tech flags are enabled for new applications. When you deselect technology flags for an app, you reduce the total number of tests the scanner will apply to your application, thus reducing scan time and false positives.

• By default, HawkScan selection of plugins that correspond to common vulnerability tests. And while there are a few default policies you can choose from, the real power comes when you create a custom policy that is tailored to your application. Check out our latest improvements to the Policy Management feature. Note that this feature is not yet part of the Optimization Panel, but definitely worth your time to explore!

Authenticated Scanning

Many web applications require user authentication to access various pages. To effectively scan for vulnerabilities, you must test all paths, including the authenticated routes. Authentication configuration can be tricky, but we have quite a lot of documentation to help guide you through the process. And always remember that you can get help at any time via the “Get more help” link on the Panel!

How does it work?

Let’s walk through a simple before and after example using the common JavaSpringVulny app.

Unoptimized scan

In the first scenario, you’ll see the new Optimization Panel on the right is reporting that none of the optimization features are enabled for this scan and the results returned 13 paths and 6 vulnerabilities.

In this scenario, Hawkscan used the base spider to crawl the application to identify the paths and the yaml configuration only contains three lines (StackHawk applicationId, host, and env.).

Optimized scan

However, in the second example, you can see that we now have all optimization features enabled. The scan results returned show 23 paths (10 more than the previous scan) and fewer vulnerabilities. This means that not only was the scan able to find more paths, but the results became more accurate by eliminating the false positives that were present in the first scan.

For reference, the yaml file now contains the authentication block, the base spider is set to false, we have supplied a custom command to run a Postman collection, and all irrelevant Db Tech Flags are disabled.

Optimizing DAST for speed and accuracy is at the core of StackHawk’s vision, and absolutely crucial in the journey to shift security testing left in your development lifecycle. We hope you find the new Optimization Panel useful on your own company’s journey! StackHawk is committed to continuously delivering not only features, but also content like webinars and blogs to give you our thoughts on tips, tricks, and best practices.

To end, I want to thank the many customers who participated in our UX design sessions, we so greatly appreciate your feedback! And with that, this is an open invitation for all of our customers to reach out to me directly with your thoughts, comments, and ideas for how we can continue to improve and support you! We LOVE feedback, the good, the bad, and even, the ugly, so don’t be shy! Feel free to email me directly at [email protected] , ping via our shared Slack channels, or send a note via a homing Hawk!

And as per usual, remember that security is a team sport, so grab your developers and share the fun of optimizing!! KAAKAWW!!

[ Lindsy Farina is a senior Product Manager at StackHawk]

Read more :

• Customized and Configurable Scan Discovery

• Security Testing Authenticated App Routes – Part 1: Cookie Authentication

• Not a user, yet? Get started with a free StackHawk trial today !