Advanced DAST: TCS RIO 210
Category
Cybersecurity
Internship At
Tata Consultancy Services
Start Date
June 18th, 2020
Completion Date
August 11th, 2020
Certification ID
546-7594914-1016
Verification Links
Certification Details
The TCS iON RIO-210 is a comprehensive 210-hour remote internship program offered by Tata Consultancy Services (TCS). This program encompasses various components, including self-learning modules, industry projects, daily activity reports, and webinars led by industry leaders.
A notable project within this internship is “Advanced Dynamic Application Security Testing to Find Defects in Web Applications,” which focuses on Dynamic Application Security Testing (DAST) methodologies. Participants engage with tools such as Burp Suite, SQLMap, and OWASP ZAP to identify and address vulnerabilities like SQL injection, cross-site scripting (XSS), and security misconfigurations in web applications.
The internship also emphasizes understanding the OWASP Top 10 vulnerabilities and the distinctions between DAST and Static Application Security Testing (SAST). Overall, the RIO-210 program aims to equip interns with practical skills in application security testing and enhance their industry readiness.
Learnings and Outcome?
Through this project, I gained insights into various techniques employed by attackers to compromise web applications and learned effective strategies to secure them.
I explored numerous web application vulnerabilities, notably:
- Injection Attacks
- Broken Authentication
- Sensitive Data Exposure
- XML External Entities (XXE)
- Broken Access Control
- Security Misconfigurations
- Cross-Site Scripting (XSS)
- Insecure Deserialization
- Using Components with Known Vulnerabilities
- Insufficient Logging and Monitoring
These align with the OWASP Top 10 vulnerabilities, a standard awareness document for developers and web application security, representing a broad consensus about the most critical security risks to web applications.
DAST vs SAST?
In my project, I explored the distinctions between Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). SAST, often referred to as “white-box” testing, involves analyzing an application’s source code or binaries without executing the program.
This method allows for the early detection of vulnerabilities during the development phase, enabling developers to address issues before deployment. In contrast, DAST, known as “black-box” testing, assesses applications in their running state. It simulates external attacks to identify potential security flaws that manifest during execution, providing insights into how an application behaves under real-world conditions.
Personal Experience
Throughout the internship, I applied both SAST and DAST methodologies to enhance the security posture of web applications. Utilizing SAST tools, I conducted thorough code reviews to identify and rectify vulnerabilities such as injection flaws and insecure coding practices early in the development cycle.
Subsequently, employing DAST tools like OWASP ZAP and Burp Suite, I performed dynamic analyses on running applications to uncover issues like authentication weaknesses and security misconfigurations. This dual approach not only deepened my understanding of application security but also reinforced the importance of integrating both testing methodologies to ensure comprehensive protection against potential threats.
How to Apply for the Internship
To apply for the TCS iON RIO-210 Remote Internship, follow these steps:
- Registration: Visit the TCS iON Remote Internships portal and click on “Get Started.” If you’re a new user, create an account by providing your email ID and other required details. Existing users can log in using their credentials.
- Activation: After logging in, select the “ACTIVATE NOW” option. Choose the RIO-210 variant and the specific project that aligns with your interests. (There are many like AI, Cybersecurity, Data Science, DevOps etc)
- Form Submission: Fill in the necessary details, including personal information, academic background, and internship preferences. Ensure all information is accurate and complete.
- Payment: Proceed to the payment gateway to complete the transaction for the RIO-210 program.
- Commencement: Once the payment is confirmed, the internship will be available in your dashboard. You can then begin your internship journey.
For detailed registration guidelines, refer to the official instructions.
My Strategy for Cracking the Selection Test
Securing a position in the TCS iON RIO-210 Remote Internship required a well-structured approach to the selection test. Here’s the strategy I employed:
Understanding the Test Format: I began by researching the selection process, which typically includes an online application, shortlisting, a written test or technical interview, and an HR interview.
Reviewing the Syllabus: I ensured I was well-versed with the relevant subjects and topics that might be covered in the test.
Creating a Study Plan: I developed a structured study plan, allocating specific time slots to each topic and ensuring consistent progress.
Practicing with Mock Tests: To simulate the test environment and assess my readiness, I regularly took mock tests and practiced with previous years’ papers.
Enhancing Problem-Solving Skills: I focused on improving my analytical and problem-solving abilities, which are crucial for technical assessments.
Preparing for Interviews: Anticipating potential interview questions, I prepared responses that highlighted my skills, experiences, and motivation for the internship.
By following this comprehensive strategy, I felt well-prepared and confident during the selection process, ultimately securing the internship opportunity.
Conclusion
Participating in the TCS iON RIO-210 Remote Internship has been an enriching experience that has significantly enhanced my understanding of web application security.
The comprehensive curriculum, including self-learning modules, industry projects, and expert-led webinars, provided a holistic learning environment. Engaging with both Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) methodologies allowed me to develop a robust skill set in identifying and mitigating vulnerabilities.
This internship has not only deepened my technical expertise but also prepared me to implement effective security measures in real-world applications. I am confident that the knowledge and skills acquired during this program will be instrumental in advancing my career in cybersecurity.
My Project Report
Refer the project file below to see my work in the internship. (Students! Feel free to use it as a reference for your projects.)