News
Fortify SCA 5.0 Extends App Protection
Fortify Software updates app-dev security and management suite.
Fortify Software Inc. plans to ship Fortify SCA 5.0, an updated version of the company's flagship application-development security suite.
Currently in beta and expected to ship by year end, Fortify SCA 5.0 is a source code analyzer comprised of three modules. Fortify Tracer scans code and protects against flaws at the QA segment of the design lifecycle; Fortify Defender monitors deployed application code and protects against live attacks; and Fortify Manager provides a Web-based dashboard for monitoring activities and tuning configurations.
New to version 5 is enhanced collaboration, enabled by the Team Server Web interface that lets the Fortify SCA dashboard tap live data flows. Barmak Meftah, Fortify senior vice president of products and services, says the new dashboard allows admins to set up distinct roles and policies for different teams.
"That's been a huge hit with our end users so far," Meftah says.
Shifting Landscape
Language support has also been extended, with full support for PHP, JavaScript, COBOL and the classic-non-.NET versions of ASP and Basic all added with version 5. Fortify SCA previously had supported C#, VB.NET, Java and C/C++, ColdFusion and stored procedure languages such as Microsoft TSQL and Oracle PL/SQL.
"The migration rate from the COM-based languages to the .NET versions hasn't been as rapid as we thought it would be," Meftah explains. "There's a large install base of these COM languages out there. We got a lot of inquiries from our install base and others."
Johannes Ullrich, chief research officer at the SANS Institute Internet Storm Center, says code-analysis tools like Fortify SCA are critical for growing corporate development shops.
"I think [code-analysis tools] are way under-deployed. I see very little use of them, and usually just for large enterprise projects," Ullrich says. "It's a huge time saver. It doesn't find all the vulnerabilities, but it finds the standards stuff and it takes a lot of the busywork out of code review."
Fortify SCA is designed to integrate with existing tools and IDEs, including Microsoft Visual Studio, Eclipse and IBM Rapid Application Developer (RAD). The Java-based suite runs on a wide range of operating systems, including Windows, Linux, Mac OS X and various flavors of Unix.
Base price for a license is about $1,200 per developer, with additional ongoing fees for support/maintenance and a subscription to updated code rules to protect against emerging vulnerabilities.
About the Author
Michael Desmond is an editor and writer for 1105 Media's Enterprise Computing Group.