HP helps businesses defend against malicious web attacks with new application security offerings

The new release of HP Application Security Center helps organizations discover, fix and prevent security vulnerabilities in their web applications.

New features in the software help bridge the gaps that exist among development, quality assurance, operations and security teams within an IT organization.

This lifecycle approach helps companies comply with government and industry regulations, such as the Federal Information Security Management Act, the Health Insurance Portability and Accountability Act, the Payment Card Industry Data Security Standard, and the European Union Directive on Privacy and Electronic Communications.

'While customer-facing applications may be the lifeblood of a business, if they are not secured, they can provide an open door for hackers to a company's most sensitive data,' said Joseph Feiman, vice president and Gartner fellow, Gartner. 'Organizations must not only find security vulnerabilities in their applications, they must fix them and be vigilant about prevention throughout the application lifecycle, from requirements definition, development and testing, through production.'

In a recent survey of 1,000 IT professionals worldwide, 80% said that responsibility for application security falls to their security or operations teams, while less than 27% said that their development or quality assurance teams share the responsibility.

According to the Web Application Security Consortium, an international group of application security experts and industry practitioners, more than 40% of web hacking incidents are aimed at stealing personal information.

Such 'personal records' are easily traded on the Internet, which makes them the easiest virtual commodity to exchange for money.

Customer adoption

Since the acquisition of SPI Dynamics in 2007, HP has increased its investment in research, product enhancements and new services in the application security area, boosting customer adoption.

As a result, five of the top six banks, three of the top four food market companies, four of the top six insurance companies, and five of the top seven public companies in the world, as ranked by the Forbes Global 2000(3) use HP Application Security Center to protect their web applications from security threats.

New research helps businesses stay ahead of hacker threats

To help organizations stay ahead of the ever-changing security threats hackers invent every day, the HP Web Security Research Group, which includes many renowned experts in the security field, has added and updated checks in HP Application Security Center for rich Internet applications, including critical vulnerabilities in Apache and MySpace plug-ins.

The new security checks are automatically updated for existing customers within 24 hours.

In addition, the group researched new security issues for Web 2.0 technologies, including Asynchronous JavaScript and XML (AJAX), Adobe Flash and Microsoft Silverlight.

Major product updates boost lifecycle approach to application security

HP Application Security Center includes HP Assessment Management Platform as the foundation of the solution, with HP DevInspect for developers, HP QAInspect for quality assurance teams and HP WebInspect for operations and security experts.

This allows customers to successfully find, fix and prevent security vulnerabilities. Enhancements to HP Application Security Center increase efficiency for these teams and help them integrate these security practices into their existing application lifecycle processes.


• HP DevInspect provides improved hybrid analysis that combines static and dynamic analysis to help find the true vulnerabilities.

Remediation efforts can then be focused on the highest risk security defects.

It provides a clear path for developers to build secure code within their integrated development environments.

Support is available for Microsoft Visual Studio 2008, Visual Studio 2005 and Eclipse.


• HP QAInspect includes the first advanced security defect management capability integrated with market-leading HP Quality Center software.

With defect staging and consolidation capabilities, application teams can filter, prioritize and assign defects based on risk to the business.

This makes security defect information available to the whole application lifecycle team, including development, quality assurance, operations and security.

Security problems are then detected and fixed more rapidly.


• HP WebInspect has been enhanced with faster runtimes and improved scanning accuracy for the security vulnerabilities that hackers most frequently exploit.

These include cross-site scripting and SQL injection.

This helps IT operations and security teams more efficiently find and fix the security defects that matter.

New software as a service offering
HP Assessment Management Platform, the foundation of HP Application Security Center, will be offered through HP Software-as-a-Service (SaaS).

Customers can quickly and cost-effectively centralize all of their web application security assessment programs into a complete solution maintained and managed by HP SaaS.

'Hacker attacks are a critical concern for IT organizations of all sizes. Now customers can get up and running quickly and involve the right teams to minimize this risk,' said Mahmoud Mounir, Software Director, HP Middle East.

'HP is helping customers address their biggest application security challenges with new software-as-a-service offerings, product enhancements and research breakthroughs from our security experts.'

HP also provides turnkey web application security assessment and penetration testing services performed by application security experts.

These services use the HP SaaS offering to accelerate the assessment of an application's vulnerabilities and help customers reduce and manage risks associated with web applications that affect their business.