Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual...
Transcript of Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual...
![Page 1: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/1.jpg)
#MicroFocusCyberSummit
Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand
Rick Smith
Product Manager
![Page 2: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/2.jpg)
Identifying the cost
Identifying the tool
A quick case study
2
Agenda
![Page 3: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/3.jpg)
Thinking about the cost
3
![Page 4: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/4.jpg)
Challenge becomes identifying the cost:
Opportunity
Time
Risk
Reputation
Features
Productivity
Relationships
Sanity!
Cliché Alert: Nothing in Life is Free
![Page 5: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/5.jpg)
Procuring secure software
Certifying new releases
Securing legacy applications
Demonstrating ComplianceLegacy Software In-house Development
Application Security Today is Complex
5
Monitoring / Protecting Production Software
Open SourceOutsourced Commercial
![Page 6: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/6.jpg)
6
It isn’t getting easier
2010
Release Frequency
Number of Applications
2020+
App App
2015
Software @ DevOps Speed
![Page 7: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/7.jpg)
Identifying the Right Tool
![Page 8: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/8.jpg)
Enterprise DevSecOps
8
![Page 9: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/9.jpg)
To a Hammer, Everything is a NailDo you need a hammer?
![Page 10: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/10.jpg)
Choosing the Right Tool
![Page 11: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/11.jpg)
The Right Fit
Open Source Analysis
Real-time Static
Continuous Monitoring
Dynamic
Static
Mobile
![Page 12: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/12.jpg)
Easily upload source from the IDE, and audit there as well
Static Made Simple
![Page 13: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/13.jpg)
Fortify on Demand
Developers (IDE)
Step 1: Develop & check-in code
Step 4: Automated
Audit
Step 3: Start Static Assessment
Source control repository
Step 2: Scheduled or triggered check-out & build
Continuousintegration server
Fortify SCA Fortify Scan Analytics
FoD security expert
(Optional) Step 5: Manual Audit
Vulnerability Management
Vulnerabilities
Vulnerabilities
Defect management
Step 6: Triage, assign & fix vulnerabilities
Bill of materialsKnown vulnerabilitiesLicense risk
Open Source Analysis
Audited static results at DevOps speed
Static – Full Build Integration
![Page 14: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/14.jpg)
Our infrastructure & expertiseYour applications
Fast dynamic, augmented with human testing
Dynamic Results at Scale – Speed and Depth
![Page 15: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/15.jpg)
Automated results in 1 minute
Full device stack testing
Mobile – Blazing Fast + Thorough
![Page 16: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/16.jpg)
Are your libraries introducing risk?
Open Source Component Analysis
![Page 17: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/17.jpg)
Real-time Static Analysis
Instant feedback within the IDE
![Page 18: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/18.jpg)
Continuous Monitoring
18
Focusing on the OWASP Top 10 with fast & lightweight scanning
![Page 19: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/19.jpg)
Putting it all together
19
![Page 20: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/20.jpg)
Balancing the Pace of Development
![Page 21: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/21.jpg)
Flexibility is critical
Automate where possible
Leverage integrations
Build security in as quality
Balancing the Pace of Development
![Page 22: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/22.jpg)
Case Study: Fortify on Demand
22
![Page 23: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/23.jpg)
Case Study: Fortify on Demand
23
Continuous lightweight static
Weekly static
Dynamic after deploy
Continuous monitoring in prodDefects to OctaneConstant feedback
![Page 24: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/24.jpg)
Question & Answer
![Page 25: Using Automatic and Manual Tests for Static, Dynamic, and ...€¦ · Using Automatic and Manual Tests for Static, Dynamic, and Mobile with Fortify on Demand ... Procuring secure](https://reader033.fdocuments.us/reader033/viewer/2022053002/5f067b2c7e708231d41834f8/html5/thumbnails/25.jpg)
Thank You.
#MicroFocusCyberSummit