static analysis - Fortify SCA/SSC Report for IA? -


i'm developer working on mid-size c# application , using fortify secure coding plugin visual studio 2010 static code analysis on regular basis. we're nearing end of development cycle , asked provide vulnerability report ia.

i've not had submit before, , ia doesn't appear familiar fortify reports. plan generate 2 or 3 reports , submit ia can decide appropriate use. i'm not quite report(s), (with options) appropriate submission ia. have access generate reports audit workbench , ssc.

so question is, fortify report (with configs) organization provide ia shop? or more generically, type of static analysis vulnerability information provide ia?

thank in advance.

my guess "ia" stands "information assurance". when deal infosec types, need precise in language, since need be. i'm transitioning being developer infosec, has been challenge me, too.

the ia team has asked vulnerability report, output of penetration testing. output of penetration test include weaknesses proven exploitable, whereas static security assessment static analysis include weaknesses in code not exploitable. there limits types of issues static analysis can find, in no way replacement dynamic assessments or penetration testing.

many companies require results of multiple types of analysis part of requirement approve application. manual penetration testing done, scanner such webinspect or appscan used scan application in place of manual pen testing. when results web app scanner combined static analysis results, covers both potential weaknesses in code typical vulnerabilities in deployed application (when running in environment production environment).

you should work ia team determine process of vetting application deployment production, responsible steps in process. need schedule them conduct pen testing on application in qa or functional testing environment.

as report, if want results of static analysis, i'd @ generating report that's less 20 pages them start, includes prevalent issues in web applications, assuming you're writing web application. i'm partial cwe/sans top 25 2010 report in ssc, without "detailed report" option.


Comments

Post a Comment

Popular posts from this blog

SPSS keyboard combination alters encoding -

my question not have programming practical issue on spss. accident keyword combination cannot remember because did not intend press changed encoding in spss , text in data in different language english shown small boxes. nevertheless, when kind of analysis performed different language text shown in output. does know reason? tried change encoding did not produce result. first, @ edit > options , see whether setting unicode or locale. might fix it. if have text in multiple languages, want unicode. otherwise, may have specific locale set wrong. can change set locale, need know locale want use.
Read more

Add new record to the table by click on the button in Microsoft Access -

in ms access form want implement separate button, adds new record table. in order added button , attached button event: private sub btnaddrec_click() refresh codecontextobject on error resume next docmd.gotorecord , , acnewrec if err.number <> 0 btnaddrec.enabled = false end if end end sub everything ok when open window , click btnaddrec button, problem when first of perform navigation through existed records , after click on button. got runtime error: 2105: «you can't go specified record. may @ end of recordset» . how solve issue, need have ability add new record on click on specific button, no matter, have walked or not walked through records before. thanks. i created simple form field call description (and autonumber) , created button code follows click event. filled number of records , navigated through them, clicked addnewrec button. form navigated new record without issues. able click addnewrec button directly after ...
Read more

CSS3 Transition to highlight new elements created in JQuery -

i want use css3 color transition apply highlight-fading color effect (yellow transparent) new elements appended markup using jquery. css #content div { background-color:transparent; -moz-transition:background-color 2s; -webkit-transition:background-color 2s; -o-transition:background-color 2s; transition:background-color 2s; } #content div.new { background-color:yellow; } html <div id="content"></div> <a id="add-element" href="#">add new element</a> js $('#add-element').click(function() { var newelement = $('<div class="new">new element</div>'); $('#content').append(newelement); newelement.removeclass('new'); }); when click link, new element created. class "new" (background color yellow) , it's appended html markup. should able remove "new" class trigger background color transition transparent (or whate...
Read more