How To Perform Web Application Security Testing Using AppTrana

An In-Depth Examination of AppTrana – A Remarkable Product for Application Security by Indusface:

In the contemporary era of digital technology, securing websites has become a necessity as every web-accessible site is exposed to possible attacks. The motives of attackers can range from gaining popularity, collecting competitive intelligence, or merely creating chaos.

Regardless of their motives, security transgressions can lead to significant financial losses. Every website open to internet traffic, irrespective of its scale, calls for an all-inclusive security solution.

AppTrana Review – Delivering Application Security to the Masses

Today, we will provide a comprehensive analysis of AppTrana by Indusface, an all-in-one application security product.

AppTrana provides a holistic solution comprising a web application scanner (WAS), a fully managed web application firewall (WAF), integrated DDoS defense, and a website accelerator (CDN).

AppTrana’s distinctive approach to application security stresses the identification of application risk stance and strengthening weak points to render effective defense. This approach differs from standard WAF solutions as it proposes a universal solution and allows users to control the system.

While other solutions might offer the choice to import scan results from other providers, it can be challenging to locate a solution that proposes automated rules for immediately patching vulnerabilities. In such circumstances, ensuring that vulnerabilities are rectified becomes the user’s responsibility.

Nevertheless, many users lack the necessary expertise to effectively administer this task. With AppTrana, users don’t need to worry about expertise. AppTrana furnishes thorough protection via its managed solution, wherein security professionals formulate the rules without expecting users to possess any specific knowledge.

For more details, please refer to our elaborate guide on Ideal Web Application Security Testing

Key Features

Here’s a rundown of some of AppTrana’s key features:

#1) Constant Vulnerability Discovery: AppTrana enables users to perform automated scans to identify OWASP Top 10 vulnerabilities regularly. Users can opt to conduct grey box tests by offering valid credentials.

#2) Manual Penetration Testing: Users can request for manual penetration tests, wherein security experts scrutinize the site to detect complicated vulnerabilities in the business layer that hackers could potentially exploit.

#3) Instantaneous Vulnerability Patching: AppTrana permits the instantaneous resolution of identified vulnerabilities via its WAF, which includes fundamental rule sets formulated by experts to defend websites against OWASP Top 10 vulnerabilities.

#4) False Positive Detection: Users can request experts to monitor the site for false positives and adjust the site rules to reduce false positives.

#5) Customized Patches: If the core rules do not resolve certain vulnerabilities, users can request custom patches crafted by security experts to ensure thorough defense.

#6) Swift Deployment without Downtime: AppTrana can be deployed within minutes without causing any downtime. All sites are automatically onboarded to manage both HTTP and HTTPS traffic. AppTrana, which is built on AWS, emphasizes security and performance in its design.

The highly dependable and scalable architecture ensures that the systems scale based on load to avert latency issues. There is no need for users to deploy additional infrastructure.

#7) DDoS Defense: AppTrana ensures website availability through superior DDoS defense. It offers two levels of protection.

• Out-of-the-box rate control rules and CAPTCHA defense are utilized to combat suspected DDoS attacks.
• Experts enact automatic alerts and customized rules to alleviate sustained Layer 7 DDoS attacks predicated on attack patterns.

In addition, don’t forget to check out our list of the leading DDoS attack tools.

#8) Website Performance Enhancement: Through its alliance with Tata Communications, AppTrana provides an integrated CDN to bolster website performance. Tata Communications’ Whole Site Acceleration (WSA) technology delivers swift speeds and reliable resilience to ensure instantaneous worldwide content access.

Inside AppTrana – Under the Hood

In this section, we will review the process of onboarding a website onto the premium plan and explore the dashboard.

Initiating the Process

To conduct a hands-on assessment on your website or web application, you can set up a free trial AppTrana account here.

It’s important to note that the premium plan does not provide a free trial. If you wish to explore the product before making a commitment, you can try the Advance plan which offers a 14-day free trial. However, for the purpose of this review, we will continue with the premium plan.

Next, you need to provide the website you want to protect. After submitting this information, make sure to review the configuration for accuracy. CDN is enabled by default, although this involves a two-step process to be explained subsequently.

Additionally, you’ll have to provide your SSL certificate, facilitating the decryption and monitoring of your website’s HTTPS traffic.

Otherwise, you can opt to use the Let’s Encrypt free certificate which facilitates the automatic generation of a certificate for your domain by AppTrana, without having to provide one yourself. Alternatively, you can also purchase an Entrust certificate from Indusface.

After completing these steps, you will need to effect a CNAME change for redirecting traffic to the AppTrana infrastructure. This completes the onboarding process, and protection commences immediately. The best part is that there’s no downtime during onboarding.

Examining the Portal

After executing the CNAME change, your website will be introduced to the AppTrana SaaS infrastructure, and its protection will commence.

• By default, sites are introduced in blocking mode with Advanced Rules applied. Indusface fine-tunes these rules to ensure zero false positives and unhindered site access.
• Premium Rules are set to logging mode and observed by Indusface security specialists. Based on their observation, the experts effect the necessary rule modifications and customization to meet your application’s needs. After 14 days, the site is transitioned to Premium Rules. This option is only available to premium users.

Upon logging in, the portal leads you to the dashboard page. This page furnishes a high-level outline of the configured websites, their vulnerability status, discerned attacks, and requisite actions.

You can select a specific site to access more exhaustive information. The Summary page provides supplementary details regarding the selected website.

This page provides a thorough overview of the selected website’s current state, equipping administrators to decide if additional action is required and evaluate the effectiveness of the security measures.

Grasping Risk Profiles

Let’s now examine the “Detect” page, offering detailed insights about detected vulnerabilities on the site, including the nature of the vulnerabilities discovered.

You can also scrutinize the safeguard/patch status of the discerned vulnerabilities. The page shows whether the vulnerabilities are capable of being defended by the Advanced Rules, Premium Rules, or Custom Rules. If a vulnerability can be corrected with a Custom Rule, you can submit a request for one by clicking the “Request Custom rule” button.

Your request will be forwarded to the Indusface team, and their security professionals will create the necessary rules for you. The unlimited allowance of custom rules is included in the premium plan, while the advance plan includes provision for two custom rules.

You can instigate an automated scan at any time or request manual penetration testing (PT) from this page. PT is conducted by security professionals to discern vulnerabilities that automated scans may not pick up.

Requests for PT scans are managed by the Indusface team, who will liaise with you for a more detailed understanding of your application prior to commencing the test. PT is typically wrapped up within four weeks of the request. This option is solely available with the Premium Subscription and is restricted to one scan every year. Further scans necessitate the purchase of a separate license.

You can also download a thorough report of the vulnerabilities discovered on your site. The report furnishes comprehensive details about each vulnerability and suggested corrective measures.

Security & Surveillance

As AppTrana is a fully managed solution, the Protection & Monitoring page primarily serves as an analytics portal, allowing users to understand what is being safeguarded and the types of attacks being thwarted. Users are generally not required to act upon significant instructions from this page.

Users can review