| fullrecord |
[{"key": "dc.contributor.advisor", "value": "Frantti, Tapio", "language": null, "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Riepponen, Mika", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2024-04-25T06:06:36Z", "language": null, "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2024-04-25T06:06:36Z", "language": null, "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2024", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/94465", "language": null, "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Tietoturva on kriittinen osa web sovelluksia ja haavoittuvuudet tulisi ennaltaehk\u00e4ist\u00e4 tai tunnistaa sek\u00e4 korjata mahdollisimman aikaisin ohjelmiston\nkehitysprosessissa. T\u00e4m\u00e4n tutkimuksen tarkoitus on m\u00e4\u00e4ritt\u00e4\u00e4 kuinka hyvin avoimen l\u00e4hdekoodin web sovellusten haavoittuvuustestausty\u00f6kalut sopivat kaupallisen web sovelluksen testaukseen jatkuvassa ohjelmistokehitysprosessissa. Tarve t\u00e4lle tutkimukselle tuli Secapp Oy yritykselt\u00e4. Arvioitavaksi valittiin kaksi avoimen l\u00e4hdekoodin web haavoittuvuusskanneria,\nZAP ja Wapiti. N\u00e4m\u00e4 kaksi skanneria valittiin sen perusteella, ett\u00e4 ne olivat ainoat viimeisimmist\u00e4 tutkimuksista l\u00f6ytyneet avoimen l\u00e4hdekoodin web haavoittuvuusskannerit, joissa\noli komentorivi k\u00e4ytt\u00f6liittym\u00e4 ja joita edelleen kehitettiin aktiivisesti. Kumpikin skanneri my\u00f6t\u00e4vaikutti kohteena olevan web sovelluksen tietoturvan parantamiseen. Kumpikaan skan-\nnereista ei tulosten perusteella sovellu integraatioputkessa ajettavaksi testiksi. Kumpaakin voidaan kuitenkin hy\u00f6dynt\u00e4\u00e4 ajoittaisena automaattisena skannerina. ZAP tarjosi enemm\u00e4n\nvaihtoehtoja mukauttaa skannausta, t\u00e4rkeimp\u00e4n\u00e4 mahdollisuus luokitella skannauksen l\u00f6yd\u00f6ksi\u00e4 v\u00e4\u00e4riksi positiviiksi ja kohdistaa skannaus vain ennalta m\u00e4\u00e4ritettyyn listaan URL-\nosoitteita sen sijaan, ett\u00e4 skanneri yritt\u00e4isi l\u00f6yt\u00e4\u00e4 niit\u00e4 lis\u00e4\u00e4. ZAP oli my\u00f6s nopeampi, tarkempi l\u00f6yt\u00e4m\u00e4\u00e4n oikeita haavoittuvuuksia, l\u00f6ysi enemm\u00e4n eri haavoittuvuuksia ja oli\nparempi l\u00f6yt\u00e4m\u00e4\u00e4n uusia sivuja crawler toiminnoillaan. Tulosten perusteella ZAP valittiin testaamaan kohteena oleva web sovellus p\u00e4\u00e4versioiden julkaisujen v\u00e4lill\u00e4 haavoittuvuuksien\nl\u00f6yt\u00e4miseksi.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Security is a critical part of web applications and vulnerabilities should be prevented or identified and fixed as early in the development process as possible. The purpose\nof this study is to determine how well open-source web vulnerability scanners suit for testing commercial web application in continuous software development. The need for this\nstudy came from Secapp Oy. Two open-source web vulnerability scanners, ZAP and Wapiti, were chosen to be evaluated. These two scanners were chosen because they were the only\nopen-source web vulnerability scanners found from the latest studies that had command-line interface and were still in active development. Both scanners contributed to improving the\nsecurity of the target web application. Neither of the scanners was so fast that it could be included in the integration pipeline as a test. Both scanners can be utilized as periodical\nautomated scanner. ZAP offered more customization options for the scan, most importantly possibility to flag scan findings as false positive and skip crawling phase and only scan listed\nURLs. ZAP was also faster, more precise, found wider set of vulnerabilties and had better crawling coverage. Based on the results ZAP was chosen to scan the target web application\nin between the releases to test each major version for vulnerabilities.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by Miia Hakanen (mihakane@jyu.fi) on 2024-04-25T06:06:36Z\nNo. of bitstreams: 0", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2024-04-25T06:06:36Z (GMT). No. of bitstreams: 0\n Previous issue date: 2024", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "48", "language": "", "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "web vulnerability scanner", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "web scanner", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "dynamic application security testing", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "dast", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "development security operations", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "devsecops", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "continuous software development", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Selection of open-source web vulnerability scanner as testing tool in continuous software development", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-202404253092", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Information Technology", "language": "en", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Informaatioteknologia", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Software Engineering", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.copyright", "value": "\u00a9 The Author(s)", "language": null, "element": "rights", "qualifier": "copyright", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": null, "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "haavoittuvuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "skannerit", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "kyberturvallisuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "ohjelmistokehitys", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "data security", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "vulnerability", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "scanners", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "cyber security", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "software development", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}]
|