Rapid7 > 实例探究 > Microsoft Trusts Rapid7 AppSpider

Microsoft Trusts Rapid7 AppSpider

公司规模

Large Corporate

地区

America

国家

United States

产品

AppSpider

技术栈

RESTful APIs

实施规模

Enterprise-wide Deployment

影响指标

Customer Satisfaction
Digital Expertise

技术

网络安全和隐私 - 应用安全
应用基础设施与中间件 - API 集成与管理

适用行业

Software
Professional Service

适用功能

商业运营

用例

网络安全

服务

系统集成
软件设计与工程服务

关于客户

Microsoft is a global technology company headquartered in Redmond, Washington, known for its software products, including the Windows operating system, the Microsoft Office suite, and the Internet Explorer and Edge web browsers. The company also produces a wide range of other consumer and enterprise software for desktops, laptops, tablets, and servers, including Internet search (with Bing), the digital services market (through MSN), mixed reality (HoloLens), cloud computing (Azure), and software development (Visual Studio). Microsoft is one of the largest companies in the world by market capitalization and has a significant influence on the technology landscape. The company has a strong focus on innovation and security, constantly evolving its products and services to meet the needs of its diverse customer base.

登录后查看完整内容

挑战

When Microsoft undertook an extensive evaluation of Web Application Vulnerability scanning solutions on the market, the company’s Cloud and Enterprise Security Services team knew it would be no small task. Microsoft wanted to build a world-class, scalable Web App Vulnerability scanning service that would serve all of their different service teams in building secure applications. With the technology landscape rapidly evolving, Microsoft foresaw that the homegrown solution it had previously relied upon for application security would soon struggle to keep pace with modern applications with rich, dynamic clients and numerous APIs on the back-end. So the team undertook an extensive, thorough evaluation that spanned several months and settled on AppSpider as one of its Web App Vulnerability Scanners, based in large part on the product’s roadmap towards being able to handle complex application ecosystems that have rich clients and RESTful APIs.

登录后查看完整内容

解决方案

Embarking on the proof of concept, the team knew they’d be looking at a range of products that all had the same basic functionality – in other words, their decision would ultimately boil down to a few key differentiators. The question was, which one would stand out from the rest as the best fit for their environment? A slew of in-depth questions would go into making the decision, such as: Given a baseline model, how effective is the scanner in discovering vulnerabilities? Are scan results available in a centralized data store that can be easily queried for later analysis and reporting? Can built-in reports be easily modified? How easily can new vulnerability tests be created and added? Can new authentication models be added to the scanner? Does the product meet regulatory compliance requirements, such as FedRAMP? How easily can built-in documentation be modified? Can custom checks specific to Microsoft be supported? Another important element was having the ability to develop custom attacks on their own, via API. “We wanted to develop an API with a common interface, with an engine in the background doing the legwork,” the PM manager added. “AppSpider had a good mix of what we needed, and the team particularly liked that the solution had extensibility and a strong API. That tipped the scale in their favor.” Another key consideration involved the fact that AppSpider would be focused on scanning Microsoft applications, so much was at stake: “We use AppSpider but it’s our API that we put in front of customers; our reputation is on the line. The fact that AppSpider has a rich API makes our lives a heck of a lot easier.”

登录后查看完整内容

运营影响

AppSpider’s ability to leverage and work with internal tools was key. However, in addition to specific product features, Microsoft also wanted a vendor with high marks for customer satisfaction. This did not just mean having a responsive support team – the team wanted a vendor who would relish the challenge of working with a large, sophisticated enterprise customer that had particular requirements.
The folks behind AppSpider have been very strong partners. They’re nimble and helpful in addressing our needs; whenever we come to them with feedback or future requests, they’ve made it happen.
A strong API and extensibility weren’t the only must-have features. The product needed to handle complex authentication schemes with high accuracy: “False positive rates are extremely important; that’s practically a given. So of course our team wants to minimize false positives as much as possible. Coverage was also a key consideration – we don’t want to have to get tons of partners to achieve the necessary results.”

登录后查看完整内容