3

Below are some of the penetration tools used in security testing services: Wireshark This is basically a network protocol analyzer –popular for providing the minutest details about your network protocols, packet information, decryption etc. It can be used on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many other systems. Burp suite is also ...


2

You can install Kali Linux. It has a massive amount of tools that you can use to perform penetration testing with. It may take a day or so to download and install. Kali Linux OS link


2

SonarQube: Plus side: OpenSource Integratable into CI Security hotsposts support Java (Swing), JS, VB, C#, Python, PHP OWASP / SANS Security Reports Down side: Not a real penetration tester, but security linter Security vulnerabilities support only Java, C#, PHP


2

Continuous education is the key. Implement a strict security policy as well. Social engineering threat originates from both internal employees and external strangers. For Internal Employees: In recent years, the most common factor in security breaching is revenge. People do not walk around with a revenge meter on the top of their heads, so there is no way ...


1

I'm more in favor of static code analyzers (e.g. Sonarqube) which also inspect code for some common OWASP issues once per sprint.


1

SonarQube also checks for security vulnerabilities (check beforehand if your application language is supported), see https://www.sonarqube.org/features/security/ . You can define different rule-sets to scan a project Users can mark issues as false-positives to discard them from future checks It can be easily integrated into your CI tool It has pre-defined ...


1

A lot of penetration testing I've seen has been black-box testing. In Agile teams, a lot of black-box testing moves to white-box testing. The nice thing about this is that white-box penetration testing can be more discrete, applied to each feature that the team develops and therefor it can be worked right into the sprint like any other type of discrete ...


Only top voted, non community-wiki answers of a minimum length are eligible