Fortify SCA 5.0 Extends App Protection -- Visual Studio Magazine

Fortify SCA 5.0 Extends App Protection

Fortify Software updates app-dev security and management suite.

By Michael Desmond
11/01/2007

Fortify Software Inc. plans to ship Fortify SCA 5.0, an updated version of the company's flagship application-development security suite.

Currently in beta and expected to ship by year end, Fortify SCA 5.0 is a source code analyzer comprised of three modules. Fortify Tracer scans code and protects against flaws at the QA segment of the design lifecycle; Fortify Defender monitors deployed application code and protects against live attacks; and Fortify Manager provides a Web-based dashboard for monitoring activities and tuning configurations.

New to version 5 is enhanced collaboration, enabled by the Team Server Web interface that lets the Fortify SCA dashboard tap live data flows. Barmak Meftah, Fortify senior vice president of products and services, says the new dashboard allows admins to set up distinct roles and policies for different teams.

"That's been a huge hit with our end users so far," Meftah says.

Shifting Landscape
Language support has also been extended, with full support for PHP, JavaScript, COBOL and the classic-non-.NET versions of ASP and Basic all added with version 5. Fortify SCA previously had supported C#, VB.NET, Java and C/C++, ColdFusion and stored procedure languages such as Microsoft TSQL and Oracle PL/SQL.

"The migration rate from the COM-based languages to the .NET versions hasn't been as rapid as we thought it would be," Meftah explains. "There's a large install base of these COM languages out there. We got a lot of inquiries from our install base and others."

Johannes Ullrich, chief research officer at the SANS Institute Internet Storm Center, says code-analysis tools like Fortify SCA are critical for growing corporate development shops.

"I think [code-analysis tools] are way under-deployed. I see very little use of them, and usually just for large enterprise projects," Ullrich says. "It's a huge time saver. It doesn't find all the vulnerabilities, but it finds the standards stuff and it takes a lot of the busywork out of code review."

Fortify SCA is designed to integrate with existing tools and IDEs, including Microsoft Visual Studio, Eclipse and IBM Rapid Application Developer (RAD). The Java-based suite runs on a wide range of operating systems, including Windows, Linux, Mac OS X and various flavors of Unix.

Base price for a license is about $1,200 per developer, with additional ongoing fees for support/maintenance and a subscription to updated code rules to protect against emerging vulnerabilities.

About the Author

Michael Desmond is an editor and writer for 1105 Media's Enterprise Computing Group.

Printable Format

comments powered by Disqus

Featured

Hands On: New VS Code Insiders Build Creates Web Page from Image in Seconds

New Vision support with GitHub Copilot in the latest Visual Studio Code Insiders build takes a user-supplied mockup image and creates a web page from it in seconds, handling all the HTML and CSS.
Naive Bayes Regression Using C#

Dr. James McCaffrey from Microsoft Research presents a complete end-to-end demonstration of the naive Bayes regression technique, where the goal is to predict a single numeric value. Compared to other machine learning regression techniques, naive Bayes regression is usually less accurate, but is simple, easy to implement and customize, works on both large and small datasets, is highly interpretable, and doesn't require tuning any hyperparameters.
VS Code Copilot Previews New GPT-4o AI Code Completion Model

The 4o upgrade includes additional training on more than 275,000 high-quality public repositories in over 30 popular programming languages, said Microsoft-owned GitHub, which created the original "AI pair programmer" years ago.
Microsoft's Rust Embrace Continues with Azure SDK Beta

"Rust's strong type system and ownership model help prevent common programming errors such as null pointer dereferencing and buffer overflows, leading to more secure and stable code."
Xcode IDE from Microsoft Archrival Apple Gets Copilot AI

Just after expanding the reach of its Copilot AI coding assistant to the open-source Eclipse IDE, Microsoft showcased how it's going even further, providing details about a preview version for the Xcode IDE from archrival Apple.