I won't talk much about false positives coz thats
pretty obvious while using any automated scanning
tool.
For SCR/SCA I tried few of the tools like Fortify and
PMD....Output from PMD was something related to good
programming practices, repeatition of code etc. and
didn't give any output related to security...
In my personal opinion Fortify is the best tool I
could explore so far. For Java applications, alongwith
Java files it also scans JSP files, XML files, struts
config etc to provide satisfactory output. But I use
to verify every output from Fortify by going to the
lines of the code that has been pointed in output and
no doubt many of the points use to be false positives.
But automated tools have limited scope so you can't
escape manual code review. Its a good practice to run
an automated tool to start with a fresh SCR. But after
doing 4-5 code reviews you might feel that you can do
a better review than tools.
I would like to know if someone could suggest better
tool than fortify.
-D
--- spammailme@gmail.com wrote:
All -
I am looking for feedback as to the 'real world' use
of Fortify SCA tool. It states it performs automated
'white box' code reviews and from a demo it does the
job pretty pretty quick. The company states it
detects security vulns (yet it seems alot are
quality findings).
Q: Can anyone provide positive or negagtive
expirences using this tool or like tool for JAVA
based apps.
Q: Can any of you provide rollout
suggestions/strategies that worked for you?
Thanks,
SomePlaceInCanada-ehhh
-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application
Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks
with real-world
examples of recent hacking methods such as: SQL
Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
-------------------------------------------------------------------------
This List Sponsored by: SpiDynamics
ALERT: "How A Hacker Launches A Web Application Attack!"
Step-by-Step - SPI Dynamics White Paper
Learn how to defend against Web Application Attacks with real-world
examples of recent hacking methods such as: SQL Injection, Cross Site
Scripting and Parameter Manipulation
https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl
--------------------------------------------------------------------------
