Fortify - Detailed Review

Coding Tools

Fortify Website
Fortify - Detailed Review Contents
    Add a header to begin generating the table of contents

    Fortify - Product Overview



    Introduction to Fortify On Demand

    Fortify On Demand, offered by OpenText, is a comprehensive application security solution that operates as a service. This platform is specifically designed to help organizations ensure the security and integrity of their software applications.

    Primary Function

    The primary function of Fortify On Demand is to provide thorough security testing, vulnerability management, and expert guidance to enhance the security of software applications. It integrates seamlessly into the development lifecycle, supporting secure development practices at DevOps speed.

    Target Audience

    The target audience for Fortify On Demand includes a wide range of organizations, from small to large enterprises, across various industries. This includes:

    Developers and Development Teams

    Who need continuous feedback on security vulnerabilities to ensure secure coding practices.

    DevOps Teams

    Who require scalable security testing integrated into their development tool chains.

    Security Professionals

    Who need robust tools for vulnerability management and remediation.

    Industry Professionals

    In sectors such as finance, healthcare, and technology, where application security is critical.

    Key Features

    Here are some of the key features of Fortify On Demand:

    Security Testing Techniques

    Supports a variety of security testing methods including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST).

    Scalability

    Can manage a few applications or thousands, making it suitable for organizations of all sizes.

    Cloud-Based Service

    Offers the flexibility and accessibility of a cloud-based service, eliminating the need for on-premises infrastructure.

    Integration with DevOps

    Seamlessly integrates into DevOps processes, enabling continuous security testing and rapid vulnerability remediation.

    Expert Support

    Provides 24/7 support from a dedicated team and a technical account manager, along with regular updates to rule packs to ensure accurate scan results and minimal false positives.

    Comprehensive Tools and Training

    Includes essential tools, training, and AppSec management to help organizations create, supplement, and expand their software security assurance programs.

    Integration Ecosystem

    Allows easy integration with various CI/CD tools such as Jenkins, Jira, Azure DevOps, and more, to create a more secure software supply chain. By leveraging these features, Fortify On Demand helps organizations protect their applications from security vulnerabilities, ensuring a secure and reliable software development process.

    Fortify - User Interface and Experience



    User Interface and User Experience of OpenText Fortify Static Code Analyzer



    Ease of Use

    • Fortify On Demand is accessible via a web browser, eliminating the need for any software installation or additional infrastructure. This makes it straightforward to launch and use, even for teams without extensive security expertise.
    • The platform provides a simple login process using a unique tenant ID, ensuring data separation and security. Additional access controls such as two-factor authentication, IP address restrictions, or single sign-on via SAML can be configured for enhanced security.


    User Interface

    • The interface is user-friendly, allowing developers and security teams to easily upload and scan their applications. The platform includes sample application assessment results to help users get started quickly.
    • During the scanning process, Fortify provides detailed results, including stack traces, line of code details, and suggested fixes. This helps in speeding up the remediation process and allows real-time monitoring of outstanding and completed tasks.


    Integration and Feedback

    • Fortify integrates seamlessly with various CI/CD tools such as Jenkins, Jira, Atlassian Bamboo, Azure DevOps, and more. This integration enables real-time feedback during the development process, enhancing productivity and efficiency.
    • The tool offers options to customize code analysis and apply specific rules to identify violations quickly, with multiple views to analyze the results. This flexibility makes it easier for users to focus on the most critical issues.


    User Experience

    • Users have praised Fortify for its ability to flag potential security risks accurately and provide clear guidance on how to fix them. For example, it can identify issues like SQL injection risks and offer immediate remediation suggestions, saving significant time compared to manual reviews.
    • While some users have noted that filtering large reports can be cumbersome and that licensing costs might be a barrier for smaller teams, the overall sentiment is positive. Users appreciate the product’s reliability, efficiency, and performance-enhancing capabilities.


    Conclusion

    In summary, the user interface of Fortify Static Code Analyzer is designed to be intuitive and efficient, making it easy for developers and security teams to identify and fix security vulnerabilities early in the development cycle. The integration with various development tools and the detailed feedback provided enhance the overall user experience.

    Fortify Website

    Fortify - Key Features and Functionality



    OpenText Fortify On Demand Overview

    OpenText Fortify On Demand, a prominent tool in the coding tools and AI-driven product category, offers a suite of features that enhance software security, development efficiency, and compliance. Here are the main features and how they work:



    Application Assessments and Automated Scans

    Fortify On Demand conducts comprehensive application assessments using various security testing techniques, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST). These automated scans help identify vulnerabilities in the code, ensuring that applications are secure from the outset.



    Vulnerability Identification and Remediation

    The tool identifies vulnerabilities and provides detailed reports on the issues found. It also offers remediation guidance, helping developers to fix the vulnerabilities efficiently. This process is streamlined with AI-driven tools like Fortify Aviator, which provides automated code fix suggestions, significantly reducing the time required to remediate security issues.



    Continuous Monitoring

    Fortify On Demand enables continuous monitoring of applications, ensuring that security is maintained throughout the software lifecycle. This feature allows for regular updates of rule packs to include the latest vulnerabilities, thereby keeping the application secure against new threats.



    AI-Driven Audit Assistant

    The integration of AI technology, such as the Fortify Audit Assistant 2.0, helps in reducing the noise of false positives in scan results. This AI tool adjusts thresholds to predict which issues are most likely to be false positives, making the results more manageable and focusing the team’s efforts on actual vulnerabilities. For instance, it can reduce the number of issues from thousands to a more manageable number, such as from 6,000 to 141, by filtering out non-exploitable issues.



    Training and Education

    Fortify On Demand includes training and education resources to help developers and security teams improve their skills in software security. OpenText Learning Services offers comprehensive enablement and learning programs to accelerate knowledge and skills in using the tool effectively.



    Integration with DevOps

    The tool seamlessly integrates into DevOps processes, supporting Agile development methodologies. This integration allows for continuous security testing and rapid vulnerability remediation, ensuring that security is embedded into the development tool chain at DevOps speed.



    Cloud-Based Service

    Fortify On Demand is a cloud-based service, providing the flexibility and accessibility of not having to install or maintain on-premises infrastructure. This makes it scalable to meet the needs of organizations of any size, from managing a few applications to thousands.



    Support and Expert Review

    The platform offers 24/7 support with a dedicated support team and a technical account manager. Additionally, it includes expert review of security assessments, ensuring that applications are thoroughly analyzed for various software security vulnerabilities.



    Code Optimization with AI

    When combined with tools like StackSpot AI, Fortify On Demand can significantly enhance code migration and optimization. StackSpot AI helps in adapting code to comply with Fortify’s security and efficiency standards, improving code efficiency, maintainability, and delivery speed. For example, it can optimize code by ensuring immutability of fields, eliminating redundant null checks, and implementing safe initialization, resulting in safer, more efficient, and easier-to-maintain code.



    Conclusion

    These features collectively ensure that Fortify On Demand is a comprehensive solution for software security assurance, leveraging AI to improve efficiency, accuracy, and compliance in software development.

    Fortify - Performance and Accuracy



    The Performance and Accuracy of Fortify

    The performance and accuracy of Fortify, particularly in its AI-driven products like Fortify Audit Assistant and Fortify on Demand, are noteworthy for several reasons:



    Enhanced Accuracy

    Fortify Audit Assistant has seen significant improvements in accuracy with its second generation. It utilizes machine learning (ML) and AI to learn from human auditors, which helps in reducing false positives and false negatives. This AI-driven approach allows the tool to contextually analyze code, identifying true positives and false positives among millions of lines of code, thereby enhancing audit accuracy.



    Predictive Capabilities

    The tool’s predictive analysis is a key feature, where it learns from past code reviews to predict potential vulnerabilities in new code submissions. This proactive approach helps developers address issues before they escalate, ensuring higher code quality and security.



    Comprehensive Coverage

    Fortify on Demand supports static and dynamic code analysis across over 33 programming languages, including languages like Java, Python, C , and many others. This broad coverage helps in identifying vulnerabilities in various types of applications, such as web, mobile, and thick-client applications.



    Efficiency in Code Review

    The integration of AI in Fortify accelerates the code review process, making it faster and more thorough. This efficiency is crucial in modern development environments where rapid deployment is essential. For instance, organizations using Fortify have reported a 30% reduction in review time, allowing for quicker deployment cycles.



    Model Drift Management

    Fortify Audit Assistant proactively manages model drift by automating the measurement and reporting of models. This ensures that the tool remains effective even as the threat landscape and programming languages evolve.



    Integration with Development Environments

    Fortify seamlessly integrates with popular development environments, including IDEs, continuous integration/continuous deployment (CI/CD) tools, and bug trackers. This integration provides developers with contextual insights directly within their workflow, ensuring they can address issues in real-time without disrupting their coding flow.



    Limitations and Areas for Improvement

    Despite its strong performance and accuracy, there are some limitations and areas for improvement:

    • Integration Issues: Fortify on Demand lacks integration with certain third-party tools like GitHub and GitLab, which can be a drawback in continuous integration environments.
    • Technical Support: Users have reported that technical support for Fortify on Demand needs improvement, with slow response times being a particular issue.
    • Code Scanning Time: Code scanning can be time-consuming, and reports could be improved for better usability.
    • Model Updates: While Fortify Audit Assistant has a commitment to quarterly model updates, ensuring these updates are seamlessly integrated and do not disrupt ongoing processes is crucial.

    Overall, Fortify’s AI-driven tools offer significant improvements in performance and accuracy, particularly in identifying and managing security vulnerabilities early in the software development lifecycle. However, addressing the integration and support issues will further enhance the user experience.

    Fortify Website

    Fortify - Pricing and Plans



    The Pricing Structure for Fortify on Demand

    The pricing structure for Fortify, specifically the Fortify on Demand service, is structured around various assessment units and subscription models. Here’s a breakdown of the different plans and their features:



    Assessment Units and Pricing

    • Assessment Units (AU):
      • These are the core units of measurement for Fortify on Demand.
      • Pricing varies based on the quantity and type of assessments:
      • 1 AU (4-99 quantity): $996.00 for 12 months.
      • 1 AU (100 quantity): $864.00 for 12 months with managed support.


    Static Application Assessments

    • 15 Static AU: $14,190.00 for single security assessments of 15 static applications.
    • 60 Static AU: $54,360.00 for security assessment subscriptions of 15 static applications.


    Mobile Application Assessments

    • 10 Mobile AU: $9,960.00 for single security assessments of 10 mobile applications.
    • 40 Mobile AU: $37,840.00 for security assessment subscriptions of 10 mobile applications.


    Dynamic Website and API Assessments

    • 30 Dynamic AU: $28,380.00 for single security assessments of 15 dynamic websites.
    • 90 Dynamic AU: $81,540.00 for security assessment subscriptions of 15 dynamic websites.
    • 20 API AU: $18,920.00 for single security assessments of 10 dynamic APIs.
    • 60 API AU: $54,360.00 for security assessment subscriptions of 10 dynamic APIs.


    Subscription Models

    • Subscriptions allow for unlimited assessments of selected applications during the subscription period. For example:
    • Static Applications Subscription: Covers 15 static applications with unlimited assessments for $54,360.00 over 12 months.
    • Mobile Applications Subscription: Covers 10 mobile applications with unlimited assessments for $37,840.00 over 12 months.


    Features Available in Each Plan

    • Static, Dynamic, and Mobile Assessments: Detect vulnerabilities across various programming languages and APIs.
    • Automated Security: Integrate with CI/CD pipelines using Swagger-supported RESTful APIs, GitHub repositories, and plugins for DevOps tools like VSTS and Jenkins.
    • Security Rating System: Uses a 5-star rating system to rate application security based on the likelihood and impact of vulnerabilities.
    • Remediation Scans: Includes at least one free remediation scan to validate fixes for identified vulnerabilities.
    • Support: 24/7 support through self-service resources and a dedicated support team of Technical Account Managers (TAMs).


    Flexible Deployment Plans

    For on-premise or hybrid deployments, there are flexible deployment plans such as the Fortify Static Code Analyzer Flexible Deployment Plan:

    • Term License: 1-year term license for $1,239.73, including 1 named contributing developer.


    Free Options

    There are no free options available for Fortify on Demand. However, the service includes a free remediation scan with each assessment to validate that the identified issues have been fixed.

    In summary, Fortify on Demand offers a range of pricing tiers based on assessment units and subscription models, each with specific features tailored to different types of application security assessments.

    Fortify - Integration and Compatibility



    Integration with Fortify

    When integrating Fortify, particularly the OpenText™ Fortify On Demand and Fortify Static Code Analyzer, into your development workflow, several key aspects of compatibility and integration are noteworthy.

    Integration with CI/CD Tools

    Fortify seamlessly integrates with a variety of Continuous Integration/Continuous Deployment (CI/CD) tools. This includes popular platforms like Jenkins, OpenText™ Software Delivery Management, Jira, Atlassian Bamboo, Azure DevOps, Eclipse, and Microsoft Visual Studio. These integrations enable you to automate security testing within your CI/CD pipeline, ensuring that security vulnerabilities are identified and addressed early in the development cycle.

    Compatibility Across Platforms

    Fortify supports a wide range of operating systems, including Windows (8.1, 10, and various server versions), Linux (CentOS, Red Hat Enterprise Linux, SUSE Linux Enterprise Server, and Ubuntu), macOS (10.15 and 11), AIX, and Solaris. This broad compatibility ensures that Fortify can be deployed in various development environments.

    Language Support

    The Fortify Static Code Analyzer is highly versatile in terms of programming language support. It covers over 33 languages, including but not limited to C/C , Java, .NET, JavaScript, Kotlin, and many more. This extensive language support makes it a comprehensive tool for diverse development teams.

    Deployment Options

    Fortify offers multiple deployment options to suit different organizational needs. You can deploy it on-premises, in the cloud, or use the AppSec-as-a-service model through Fortify On Demand. This flexibility allows organizations to choose the deployment method that best fits their infrastructure and security requirements.

    Security Testing Techniques

    Fortify On Demand supports a range of security testing techniques, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST). This comprehensive approach ensures that applications are thoroughly vetted for security vulnerabilities from multiple angles.

    Scalability and Efficiency

    The tool is designed to scale with your organization’s needs, whether you are managing a few applications or thousands. It provides a scalable, centralized scanning infrastructure and supports dynamic scaling of SAST scans to meet the demands of your CI/CD pipeline. This ensures efficient and accurate security testing without overwhelming your development resources.

    User Experience and Support

    Fortify integrates well with development tools, providing immediate results in the Integrated Development Environment (IDE) through the Security Assistant. It also offers comprehensive support, including 24/7 technical support and a dedicated technical account manager, to help you get the most out of the platform.

    Conclusion

    In summary, Fortify’s integration capabilities and compatibility across various platforms, languages, and deployment options make it a powerful and flexible tool for ensuring the security of your applications throughout the development lifecycle.

    Fortify Website

    Fortify - Customer Support and Resources



    Support Options



    Standard Support

    This is included with all purchases and provides access to support through various methods such as online chat, support tickets, email, or telephone. The Micro Focus Support Team is available to assist directly or coordinate the delivery of support. The response and resolution time is determined by the severity of the request.



    Managed Support

    Available for purchases of more than 100 Assessment Units (AUs) or as an optional purchase for fewer AUs. This includes all features of Standard Support plus a dedicated Customer Manager as a primary point of contact. Additional benefits include on-boarding for the first development team, live portal walk-throughs, and integration tools walk-throughs.



    Premium Support

    This optional service includes all features of Managed Support, plus an Application Security Program Manager (ASPM) available during standard business hours. It also offers increased support for on-boarding development teams, more frequent results review calls, unlimited custom integrations, and one on-site visit per year if necessary.



    Additional Resources



    Training and Onboarding

    Fortify on Demand provides instructional emails, recorded demos, and live walk-through sessions for the portal and integration tools. Additional training sessions can be purchased to ensure teams are well-equipped to use the platform.



    Documentation and Online Support

    The FoD web portal offers extensive product documentation and online support resources, including how-to videos and online chat support.



    24/7 Service Operations Center

    Micro Focus maintains a 24x7x365 Service Operations Center, which serves as the single point of contact for all support-related issues. This ensures continuous support and quick resolution of any problems that arise.



    Integration Ecosystem

    Fortify on Demand features an easy-to-use integration ecosystem that allows for seamless integration into DevOps processes and development toolchains, including build servers and IDEs. This helps in creating a more secure software supply chain.



    Regular Updates

    The platform regularly updates its rule packs with the latest vulnerabilities to ensure scan results are accurate and false positives are minimized. This continuous updating helps in identifying and fixing vulnerabilities quickly.

    By providing these comprehensive support options and resources, Fortify on Demand ensures that customers can effectively manage and enhance their application security with minimal disruption.

    Fortify - Pros and Cons



    Advantages



    Comprehensive Security Testing

    Fortify On Demand offers a wide range of security testing techniques, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST). This ensures thorough vulnerability detection across various application types.

    AI-Powered Code Fix Suggestions

    Fortify Aviator, an integral part of the Fortify suite, leverages AI and machine learning to provide actionable fix suggestions for identified security issues. This significantly reduces the time developers spend on remediation, boosting productivity and maintaining coding flow.

    Scalability and Flexibility

    Fortify On Demand is highly scalable, capable of managing a few applications or thousands, making it suitable for organizations of all sizes. It can be deployed in the cloud, on-premises, or as an AppSec-as-a-Service, offering flexibility in integration and deployment.

    Integration with Development Environments

    Fortify seamlessly integrates into modern development environments and DevOps processes, enabling continuous security testing and rapid vulnerability remediation. This integration supports Agile development methodologies and enhances the overall security of the software supply chain.

    High Accuracy and Minimal False Positives

    Fortify’s static code analyzer is highly accurate, with a 100% true positive rate in the OWASP 1.2b Benchmark. This reduces the burden on developers by minimizing false positives and providing detailed, line-of-code guidance for fixing vulnerabilities.

    Continuous Improvement

    The AI-driven features of Fortify Aviator learn from past fixes and developer feedback, continuously improving the accuracy and effectiveness of its suggestions over time.

    Disadvantages



    Slow Support for New Technologies

    Fortify On Demand can be slow to support new technologies or new software versions, which may delay the adoption of the latest advancements in development environments.

    Integration Issues

    There can be integration issues with third-party tools like GitHub, which may impact the usability and efficiency of the platform.

    Time-Consuming Code Scanning

    Code scanning with Fortify can be time-consuming, and the reports generated may need improvement to be more user-friendly and actionable.

    Technical Support Response

    Users have reported slow technical support response times, which can be frustrating when immediate assistance is needed.

    Need for Improved Bug Tracker Integration

    There is a need for improved integration with bug tracker systems to enhance the overall workflow and efficiency of the development and security teams. By weighing these advantages and disadvantages, you can make a more informed decision about whether Fortify aligns with your organization’s needs and workflow.

    Fortify Website

    Fortify - Comparison with Competitors



    Unique Features of Fortify On Demand

    • Comprehensive Security Offerings: Fortify On Demand stands out for its extensive security testing capabilities, including Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Mobile Application Security Testing (MAST). It provides continuous monitoring and vulnerability management, making it a holistic solution for software security assurance.
    • Scalability and Flexibility: The platform is highly scalable, capable of managing a few applications or thousands, and offers the flexibility of a cloud-based service without the need for on-premises infrastructure.
    • DevOps Integration: Fortify On Demand seamlessly integrates into DevOps processes, enabling continuous security testing and rapid vulnerability remediation. This is particularly valuable for organizations adopting Agile and DevOps methodologies.
    • Expert Support and Updates: The service includes regular updates to rule packs to ensure the latest vulnerabilities are addressed, and it offers 24/7 support with a dedicated support team and a technical account manager.


    Potential Alternatives



    Tenable.io Web Application Scanning

    • Automated Scanning: Tenable.io is known for its automated scanning capabilities and advanced integration options. It provides robust security management features but may have a more complex setup process and higher initial costs compared to Fortify On Demand.
    • Ease of Deployment: While Tenable.io has a straightforward deployment process, it faces criticism for delayed customer service responses, which could be a significant factor for some users.


    GitHub Copilot and Other AI Coding Assistants

    While not directly comparable as they are more focused on coding assistance rather than security, tools like GitHub Copilot can be seen as complementary rather than alternatives.

    • GitHub Copilot: This AI-powered coding assistant offers real-time coding assistance, automated code documentation, and test case generation. However, it is more focused on coding efficiency and quality rather than security testing.
    • Amazon CodeWhisperer and Other AI Tools: Tools like Amazon CodeWhisperer and AskCodi provide AI-driven code suggestions, function completion, and documentation generation. They also offer some security scanning features but are not as comprehensive in security testing as Fortify On Demand.


    Key Differences

    • Focus: Fortify On Demand is primarily focused on application security testing and vulnerability management, whereas tools like GitHub Copilot, Amazon CodeWhisperer, and AskCodi are focused on coding assistance and productivity.
    • Integration: Fortify On Demand integrates deeply into the DevOps lifecycle for continuous security testing, whereas AI coding assistants integrate into development environments to enhance coding efficiency.
    • Support and Updates: Fortify On Demand offers extensive support and regular updates to address the latest security vulnerabilities, which is a critical aspect for maintaining secure software.

    In summary, while Fortify On Demand excels in comprehensive security testing and vulnerability management, other tools like Tenable.io and AI coding assistants serve different needs within the development lifecycle. Depending on the specific requirements of an organization, these tools can be used in conjunction with Fortify On Demand to ensure both secure and efficient software development.

    Fortify - Frequently Asked Questions



    Frequently Asked Questions about Fortify



    What is Fortify Static Code Analyzer and how does it work?

    Fortify Static Code Analyzer (SCA) is a tool used for static application security testing. It analyzes an application’s source code to identify and remediate vulnerabilities. The process involves reading source code files, converting them into an intermediate structure, and then using multiple specialized analyzers and a knowledge base of secure coding rules to locate security vulnerabilities. This approach helps in finding and addressing vulnerabilities early in the development lifecycle.

    Which programming languages and platforms are supported by Fortify Static Code Analyzer?

    Fortify SCA supports a wide range of programming languages, including but not limited to C/C , Java, C#, Python, Go, Kotlin, PHP, Ruby, Swift, and many others. It also supports various platforms such as Linux on ARM, IBM AIX 7.3, and macOS 14. Additionally, it integrates with several build tools like Gradle, Maven, MSBuild, and Bazel.

    How does Fortify integrate with development tools and CI/CD pipelines?

    Fortify integrates seamlessly with popular Integrated Development Environments (IDEs) like Eclipse, Visual Studio, and JetBrains (including IntelliJ). It also supports various CI/CD tools such as Jenkins, Bamboo, Azure DevOps, GitHub, GitLab, and Maven. This integration allows for automated security scans and issue tracking within the development lifecycle.

    What are the benefits of using Fortify in the Software Development Life Cycle (SDLC)?

    Using Fortify within the SDLC can significantly reduce development time and cost. It helps in identifying vulnerabilities early, which is 30 times less costly than fixing them in the production or post-release phase. Fortify also enhances secure coding practices by educating developers about static application security testing, and it can find up to 2 times as many vulnerabilities with up to 95% reduced false positives.

    How does Fortify on Demand differ from Fortify Static Code Analyzer?

    Fortify on Demand is a cloud-based service that offers application security testing, vulnerability management, and compliance. Unlike the on-premise Fortify Static Code Analyzer, Fortify on Demand allows users to schedule and manage security assessments through a web-based portal, avoiding the need for maintaining infrastructure. It provides visual dashboards and reports for reviewing results and supports static, dynamic, and mobile assessments.

    Can Fortify be customized to include specific security rules or integrations?

    Yes, Fortify allows for customization. Users can extend and expand static analysis capabilities by creating custom rules using the rules builder. Additionally, Fortify supports various integrations with issue trackers like Jira, Bugzilla, and open source security management tools like Sonatype, Snyk, and WhiteSource. It also provides a Swaggerized API for unlimited customization.

    What new features have been added in recent versions of Fortify?

    Recent versions of Fortify have introduced several new features, including support for new languages and frameworks (e.g., .NET Core 9.x, Angular 17, Go 1.23), new build tools (e.g., Bazel 7.x, Gradle 8.5), and enhanced platform support (e.g., Linux on ARM, IBM AIX 7.3). There are also updates to scan policies, support for Flask framework and Jinja2 templates, and improved integration with tools like Azure DevOps and IntelliJ IDEA.

    How does Fortify handle false positives and issue management?

    Fortify is designed to minimize false positives, with some versions reducing them by up to 95%. The tool provides detailed scan results and recommendations, allowing developers to quickly identify and address real vulnerabilities. Issues can be manually or automatically pushed into defect tracking systems like Jira and Bugzilla, facilitating transparent remediation of security issues.

    What kind of support and resources are available for Fortify users?

    Fortify users have access to comprehensive support resources, including documentation, technical notes, and release notes. Users can contact OpenText Fortify on Demand customer support through live chat, support tickets, or phone. There are also community resources, such as the Fortify Unplugged YouTube channel and the OpenText Community, which provide feature videos and product announcements.

    Can Fortify be used for open source software composition analysis?

    Yes, Fortify supports open source software composition analysis. Tools like Fortify on Demand and Fortify ScanCentral SAST can perform assessments on open source components. For example, the Debricked CLI can be used for open source software composition analysis with Fortify on Demand.

    How does Fortify ensure continuous application monitoring?

    Fortify on Demand offers continuous application monitoring features. Users can configure application monitoring, schedule dynamic scans, and view risk profile results. This continuous monitoring helps in identifying and addressing security vulnerabilities in real-time, ensuring the ongoing security of applications.

    Fortify Website

    Fortify - Conclusion and Recommendation



    Final Assessment of OpenText Fortify

    OpenText Fortify, particularly the Fortify On Demand solution, stands out as a comprehensive and highly effective application security tool in the coding tools and AI-driven product category.

    Key Benefits



    Comprehensive Security Testing

    Fortify On Demand offers a wide range of security testing methods, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST), and Mobile Application Security Testing (MAST). This ensures that applications are thoroughly scanned for vulnerabilities at various stages of the development lifecycle.



    Integration and Scalability

    The solution seamlessly integrates into existing development environments, supporting DevOps and Agile methodologies. It can scale to manage a few applications or thousands, making it suitable for organizations of all sizes. The cloud-based service eliminates the need for on-premises infrastructure, providing flexibility and accessibility.



    Expert Support and Continuous Feedback

    Users benefit from 24/7 support from a dedicated team and a technical account manager. The solution provides continuous feedback to developers, enabling rapid vulnerability remediation and ensuring that security issues are addressed promptly.



    Accuracy and Efficiency

    Fortify On Demand includes expert manual review of scan results, regular updates of rule packs with the latest vulnerabilities, and features to reduce false positives. This enhances the accuracy of scan results and speeds up the remediation process.



    Compliance and Regulatory Adherence

    The tool comes with pre-configured policies and reports for major compliance regulations such as PCI DSS, DISA STIG, NIST 800-53, ISO 27K, OWASP, and HIPAA, ensuring that applications meet stringent security standards.



    Who Would Benefit Most



    Development Teams

    Developers will benefit from the continuous feedback and detailed reports that include stack traces, line of code details, and suggested fixes. This helps in early detection and remediation of vulnerabilities, ensuring that the application development process is secure from the outset.



    Security Teams

    Security professionals will appreciate the comprehensive security testing capabilities, the ability to manage a large number of applications, and the expert support available. The solution helps in identifying and addressing security issues efficiently, reducing the workload and improving overall security posture.



    Organizations with Compliance Requirements

    Companies that need to adhere to various security regulations will find Fortify On Demand particularly useful due to its pre-configured policies and reports for major compliance standards.



    Overall Recommendation

    OpenText Fortify On Demand is a highly recommended solution for any organization looking to enhance its application security. Its ability to integrate smoothly into development environments, provide comprehensive security testing, and offer expert support makes it an invaluable tool. The cloud-based service is easy to use, scalable, and ensures that applications are secure throughout the software development lifecycle.

    Given its extensive features, scalability, and the support it offers, Fortify On Demand is an excellent choice for development and security teams aiming to ensure the security and compliance of their applications. The free trial option allows potential users to experience the benefits firsthand, making it a risk-free initial investment.

    Fortify Website
    Back to Detailed Reviews Main Page
    Scroll to Top