Production Safety

The Black Duck Threat Research Center (TRC) manually reviews your web application and customizes Continuous Dynamic testing for safety and thoroughness. Every input, state changing request (POST request), or sensitive functionality is carefully analyzed by a human TRC engineer. Our engineers check this functionality first for safety, then for depth and coverage.

This is especially applicable to administrative level functionality—things like create/delete users or groups. This kind of functionality is deemed unsafe to test in an automated fashion and Continuous Dynamic will be configured not to place these sensitive requests. Instead, a security engineer can check this functionality by hand in order to ensure little to no impact on the application. Examples of functionality that are commonly deemed unsafe:

Many scanners bombard your site with hundreds or thousands of simultaneous requests, running the risk of negatively affecting or even bringing down the site being tested. Instead, Continuous Dynamic uses single-threaded requests during the automated portion of the web application assessment; much like a real user, Continuous Dynamic sends a request to your website and waits for a response before submitting the next request. In addition, by default Continuous Dynamic will place a maximum of four requests per second for a given set of credentials. (You can control this cap from the Continuous Dynamic Portal interface.) This approach ensures that your production sites never receive an unexpected heavy load of requests coming from our scanner.

By leveraging customized testing methodology unique to Continuous Dynamic in combination with our TRC’s vulnerability verification process, Continuous Dynamic is able to detect vulnerabilities safely without executing live code on your web application. You are guaranteed that Continuous Dynamic will never execute live code in an automated fashion on your website. This greatly reduces the chance of negatively impacting the application.