Web Application Security in a Large Organization -…

This article describes a practical, step-by-step approach to discovering, cataloging, and securing an organization's external and internal web applications—particularly in the context of mergers and acquisitions—covering asset discovery (IP/DNS/BGP lookups, Google enumeration, zone transfers), building an application inventory, automated and manual vulnerability testing (Nessus/OpenVAS, dynamic scanners, manual web testing), and establishing vulnerability management and monitoring to move from reactive firefighting to proactive security.