ebook

Good Habits of
Bad Actors
Life hacks for your security strategy
 ¤œ ¯¯  ¾  ¨  À££   «¯
¨ º ·  ¯¯ 
¯ ¯ ”  ¨  À££ £
¯ ¯
 ¯ º
W,+"&"*%53$,&#(853*3,3+*-3*43,/,(3,22%,++9.3 *-$32,2&",++93,23
-*3 8,238(7%-,-"*2:3b$(98(3**3,-3!$,-3-$(93*.3-$*8*%$+93
5-%9"23-$(3!(,#(5-37*"2-53*43,&&(553,23"2(5-",-"23-$(3(2-"8(3
(2"8*2/(2-3 (4*8(3/,#"23-$("83/*(:3s2.3-$(93*7(8,-(3*23
/"2"/,+3(}7*5%8(.3+(,"23,53+"--+(34*8(25"&34**-78"2-3,53-$(93&,23 93
%5"23-$(3+,-(5-3-**+5.35%&$3,53 (2"23(2(8,-"(3s3-*3$(+73/,#(3
7$"5$"23,--,&#53/*8(3&*2"2&"2:3q8*/37$"5$"23-*38,25*/!,8(3
,23 8%-(p4*8&(3,--,&#5.3-$(3 ,3%953,8(3(o&"(2-3,23%2, ,-"2:
      

;931610.3/,+"&"*%53$,&#(853!"++38%23%73, *%-36:03-8"++"*23"23
+* ,+3&*5-53((8939(,8'
-53(5-"/,-(3-$,-3*2+93, *%-33*43&9 (8&8"/"2,+53,8(3
&,%$-3,237%2"5$(
-3-,#(53163,953-*3"(2-"493,3 8(,&$3,2363,953-*3&*2-,"23
"-.3*23,(8,()
3*43 8(,&$(53,8(32,2&",++93/*-",-(3!"-$"23*8,2"(3
&8"/(38*%75
Õ3K9 (85(&%8"-93Ò(2-%8(Ø ö3;W3K*5-3*43,3ï,-,3;8(,&$3ê(7*8-3161ä
Û3K9 (83Ì}7(8-5 â3Ò(8"*23ï,-,3;8(,&$32(5-",-"*253ê(7*8-3161
23mh.34,/(3$,&#(83b$(3W(2-*837% +"5$(3,23(55,9P
Gb$(3K*25&"(2&(3*43,3>,&#(8.3!$"&$3 (&,/(3#2*!23,53Vb$(3
>,&#(853W,2"4(5-*:E323-$(3(55,93$(3!8*-(O3VC(5.33,/3,3
&8"/"2,+:3W93&8"/(3"53-$,-3*43&%8"*5"-9:3W93&8"/(3"53-$,-3*43
*%-5/,8-"239*%.35*/(-$"23-$,-39*%3!"++32((834*8"(3/(34*8:33
,/3,3$,&#(8.3,23-$"53"53/93/,2"4(5-*:3C*%3/,935-*73-$"53
"2""%,+.3 %-39*%3&,2-35-*73%53,++F3,4-(83,++.3!(8(3,++3,+"#(:D
W*8(3-$,23039(,853+,-(8.3"-53$,832*-3-*3-$"2#3-$,-3,++3-**3/,293
7(*7+(3$,(3-,#(23-$(3!*853V3,/3,3&8"/"2,+E34,83-**3+"-(8,++9:3
f$(235&8%-"2""23-$(3&%88(2-35-,-(3*43&9 (85(&%8"-9.3"-3"53&+(,83
-$,-3&8"/"2,+3$,&#(853,8(3"2((3&%8"*%5.3-$(93,8(3/,29.3,23
-$(93#2*!3$*!3-*3!*8#3-*(-$(838(+(2-+(55+9:3;%-3!(3&,23+(,823
48*/3-$(/:3W,293*43-$(3$,&#(85.3(-$"&,+3*832*-.3!$*34*++*!(3
-$"53/,2"4(5-*3-$8*%$3-$(3+,-(3m653,23mm653,8(3(/ ((3
"2-*3b3-*,9.3$(+7"23%535$,7(378*&(55(53,2378*&(%8(53!"-$3
-$(39(,853*43#2*!+((3,23!"5*/3-$(9(3,&&%/%+,-(348*/3
("237,8-3*43-$,-3&*++(&-"(:3439*%37,93,--(2-"*23-*3-$(5(3
+(,82(3$, "-53,23 (5-378,&-"&(5.3-$(239*%3&,235-,93*<3-$(3
7$"5$"23$**#.3-**:k
š• ” —
¤¯¯¨   ¯«  ¨ ¯
  ££ œ ¯ ¨œ  
üû
 £ vvž
    

      h=fv     v

  
($54:#96+08&:/,.:0#)#45+:54456":&.'568:*$8.8:&,'4*5.8:#&:

6,9986480:4,:/,.:,.)59#54#,9&:984*,."3:/,.:$/&#65+:

54456":&.'568:*$8.8:890,#94:081#68&:+#183:590:/,.:$!59:

54456":&.'568&:45.)8480:4$.,)$:&,6#5+:89)#988.#9):590:
;56"8.&:5.8:18./:5*5.8:,':4$8#.:45.)84:891#.,9!894%:($8/:
$#&$#9):54456"&%
!,9#4,.:590:5 &,. :818./4$#9):4$8/:6593:#96+0#9): +#6+/:

515#+5 +8:#9',.!54#,9:5 ,4:4$8#.:45.)84&:590:4$8:&86.#4/:

^&8:5:0/95!#6:5+#654#,9:&86.#4/:48&4#9):eUX-(J:4,,+:4,:., 8:/,.:
4,,+&:4$8/:&8%:-6$:59:, &8.154#,95+:8/8:5++,*&:4$8!:4,:
*8 :54456":&.'568:',.:*85"98&&8&:+#"8:59:54456"8.:*,+0G
#))/ 56":,:,':,4$8.:75*&:590: )&:590:),:8189:0888.: \

#94,:$/&#65+:590:1#.45+:&/&48!&%:98:825!+8:#&:59:54456"8.: a&45 +#&$:590:!595)8:5:*8 :5&&84:#91894,./:4,:908.&4590:818./:

,4894#5+:54456":,#94F
+,,"#9):',.:4$8:984*,.":&#)954.8&:,':,4,'0548:&,'4*5.8:

4$54:$5&:"9,*9:82+,#4&% A!+8!894:5:&,'4*5.8: #++:,':!548.#5+&:e-E?J:4,:"88:4.56":,':4$#.0

5.4/:6,!,9894&%

=<
 H.7D2/A.+=62/;.F+/:<9,8

s"%"&%& "!" %  %&%""%%% " %&%
 % %&%

"& & %&] %&%
% " %&% "%"% " %& %& %%
%!" %
%& &% % "% !%& "# &"%" %&% %%
)('/362/1/517046/.7/1--6,,/-.72+.4*   %%&%
%& &% %  %"%&%"&%"&

\61+7/o.+6/1T.F2/-.U6+O7=/;.F+/:<9,/170/,6-F+O7R
 &  &%&% " &%"% % %!"%&  % ;.F+/5O0067/J6T/1221-I/,F+A1-6
&%!" & %&%"% !%"%  "%% "%
&%"% %"%!" % " %&%&% % %
  %&%
 %&% &  % %  % %&%
" "%  

& &%&#"&% %& "%% % %!! &%%& %

 % % ""%
$
&% " &%&% &  &%&%%!&&&%&% &%&%
 %&% "#!" %&" " "%  % %"% %

% %& "%"&%""%% % %& "% % %"%

&% %%
.U6Ž
!& % !%"" %  %"%"% #  %"% "  . U66Ž Ž 9,,
 Š.F+/:<9,
U 9 ¢
$ F++//::<<ŸŸ››––œœ ¤¡žžž¢ž¢
Š..¥ž¡™Ÿœ£›š˜™Ÿ›–œ

" % %
"&!%%  %
"%%& "&%  %!! %&%!!% F
Š¥.ž—ž“›’••¤¡”›¥™Ÿ‘¤¡ž
™
¡™Ÿœ£ ›š ¥™ŸŸ‘‘¤¡ž
›š ˜˜
% %&%%% % % % % %&% &%&%" Ÿœ£••¤•¡¤¡””›¥› ™
“™›’
¡
¥ž ž“›’•
—
—

6+
¯5O26/<1§6+ 6+ 6/<1§
/<1§ O2
¯5O26 ¯5

(°
 ¤£ ¡  

       j@h n q vq m
 



 
 
   (66=6209</='9$9769;3=5<'=394;+0:=;62933+6<573=*6;,=+<=3+763=

5<'=3C9;=2;6.=2;+40+6<=(>9:='6<z0=39=0>9=35.9=06673=5<'=
 
     
*6;,86*3/=5<'=0>9:='6<z0=3>5;9=+<26;.50+6<=*+0>=954>=60>9;=

|:=+.;6$+<)=46775#6;50+6</=9$9;:6<9=+3=6<=0>9=35.9=5)9=5<'=
(>;950=5406;3=5;9=910;9.97:=9-4+9<0=50=,<6*79')9&3>5;+<)=
45<=;9'49=;+3,=953+9;
%9$9;=#99<='6*<=5=!9''+0=;5##+0=>679 =9=>5$9=(>9:=,<6*=

>6*=06=*6;,=06)90>9;=+<=);63/=46775#6;50+<)=6<=06673=5<'=
Q39=06673=0>50=*6;,=*+0>=675;=+339=0;54,9;3=5<'=NWN]=75026;.3=
*6;,86*3=06=.5,9=0>9+;=7+$93==5<'=0>9+;=4;+.93==953+9;=73/=
7+,9=I+;5=5<'=I9<,+<3H
;95'+7:=5$5+75#79=795;<+<)=.509;+573=6<=0>9=<09;<90=.95<=0>50/= f

*+0>=;540+49/=>54,9;3=45<=25+;7:=953+7:=#946.9=919;03=+<= `305#7+3>=5=;64933=26;=4795;/=46<3+309<0=46..<+450+6<=5#6^

394;+0:=630;9G
394+"4=5;953=62=394;+0:=5<'='9$976.9<0

.;6$9=46.7+5<49=5<'=544;54:=*+0>=06673=0>50=6C9;=#+70&+<=

4>94,3=5<'=;96;03G

0=394;+0:=+<06=0>9=NWN]=+97+<9=5<'=25+7=#+7'3=+2=4;+0+457=85*3==

5;9='+346$9;9'

@?
"! 5420,5.,+)'*&15,/,'1(%,-.53($#
N   E    @
    @
        
 @   
           
  


       
  
         
  
c',51()5[20*%Z5&Y,5[(.&5(T5*%&,Z'2&*(%.^
      Š    
          
   
 } }} Š    
            
   y      }§
v–›ut

z,2'%5[(',52$()&5$)*‹n*%Z5.,+)'*&15*%&(51()š
wkzj5i*&Y5¦%/*+&*-.5e!d5*%&,Z'2&*(%.
!©
 ž ›šš™ 

c:a s m      

       

P&&"(0&'26,2025/'2&*7*1/1.2*+2&'/(,/&"(6.'-2/,/&60))'2%/2
      
0)6&0.6*12,/&"(6.'2%3/(/20276,,./2612'*"(2,.(0./$'2&012

 
   &0",/202*761*2/w/&.2*+2(*)/7,2*(202.*2,/&"(6.'2/.2

P&&"(0./2.**),2/10)/2'*"2.*2|12(/0)2!")1/(06)6.6/,2/+*(/2

.3/'2/&*7/2(/0))'26$2(*)/7,-2,0!61$2'*"(2./072.67/
81236,27016+/,.*-2#3/24/1.*(2,0',2.30.236,2&(67/2%0,2

*".,70(.61$236,2!6&.67,2 20123/2%0,1.2%(*1$2401'230&5/(,2

.05/2/!/('2**(."16.'2.*2"/,.6*12012!/(6+'2,*2.30.2.3/'251*%2 ]*761/2'1076&201261./(0&.6!/2KMPJ#H8PJ#E2,&01,2.*2&3/&52/!/('2

&*(1/(2*+20120)6&0.6*1@
.3/'(/2*/(0.61$2%6.32.3/27*,.2!0)"0)/261+*(70.6*12*,,6)/2
T
8+2%/2%01.2.*25//20&/-2%/21//2.*2(/)/1.)/,,)'2"/,.6*12012 J/)/&.20120".*70./2.**)2.*2,0!/2.67/-2(/"&/2701"0)2%*(5)*0,-2012

!/(6+'2/!/('.361$-2",.2)65/2.3/'2*2/+*(/20120..0&5 67(*!/20&&"(0&'?

;**52+*(20120)6&0.6*12,/&"(6.'2,*)".6*12%6.32[/(*21*6,/2.*2)*%/(2+0),/2

*,6.6!/2(0./,

:9
*)(386421630563/00/1.3-27,/16+ j7ff,b`/-643-1/ccXci3Xh_7fW6-3/1127/1]+

¥  # '  ' '# %!  '  "  % '&  
N # " &' %#    ''% ' '% '" 
#   '  ''   "  '‚ !' % ' &
"# % 
'' " '  &  ' %##
  '%" < }| &'z '! "# '!   }}}y

'' # '    #%'  '#' " <'!  '#'– ' '# " x  '&  ' #  '  'w

 ' ' '  '' ' 

# ' # 
 ' '##" '

' #''% & %'  &&#%

6/7c3hf763/`f203_7ff,b`/-643-1/ccXci3¤X053©cWX10X

  %% '%  '  

&! %##  ' # #    ' % " & 

   

 ''   '%#%  '%  &'& # 

& & &'''% ' ' !' % " '$

&'' &    &

#  "  & % '   '   &   ''   #%

)­
"!IF™k—E!I

°    ¬­¸     º > º > P 
P

  >

> >
¢    >   M M 
  Ç 
 

  
P ƒ    >>  

P    PÖ8  

>     
>    

 :Ÿ

º


 8  Ç Ã
 >  

 ¢ ·   > 
 >   


 
} 
P Ÿ
 µ         ·
  

 


#"!  @#HGFEIFD f#nFFkFD Š#"!I‘EIkE‘D

         :> 
 +2-8 b 
T 
   ƒ  >   

     >    
 
    
    


    > >   PM 
   
 }  


     >
  
  > >   
 

  „



    >
          >

•
 <-:86'3079380-8%-'5.9-,+7:93:5./-68(5+0-
.5:*+392-9881./-70(-+5(*:5(-%+3:9380-%8+-
)5&45:$,.-#311-"51,-28*-.972-805-.95,-7"57(-
8%-9"5-'7(-!*2.-98-8*9.67+9-9"56-'5%8+5-9"52-
8*9.67+9-28*;
                 


 
Invicti: Zero-compromise web application security

Invicti Security – which acquired and combined AppSec

leaders Acunetix and Netsparker – is on a mission: application
security with zero noise. An AppSec leader for more than 15
years, Invicti delivers continuous application security,
designed to be reliable for security, practical for development,
and serve critical compliance requirements. Customers
choose Invicti’s DAST, SCA, and IAST solution to better secure
and ultimately reduce risk across their web applications and
APIs. Invicti operates globally with employees in over 11
countries and serves more than 4,000 customer organizations.
For more information, visit www.invicti.com

LinkedIn X Facebook Instagram © 2023 Invicti