HP Fortify on Demand is probably one of the best available Source Code Analysis services for tracing security leaks, and code weaknesses. Which is why we use Fortify to analyze application code prior to delivery. Read this blog to find out more about the type of weaknesses that Fortify on Demand can find…
Safety foremost
It’s in the interest of BSL and our clients that our web software and applications are safe and secure. Because of this we choose to employ the most powerful Source Code Analyse services available, including Fortify on Demand services from HPE. We analyze the code and the libraries we use to develop web applications as part of our development work. As a result, we are able to identify potential code weaknesses, modify our code, and protect clients and their website users from attack.
Fortify on Demand
Previously, we’ve worked with alternative tools, including Klocwork and FindBugs. We’ve switched to Fortify on Demand, because this provides many unique features, and is highly valued by our clients. We can now quickly identify many types of potential weakness that hackers may use to attack or even disable web services. Fortify can identify static code issues, simply by scanning the code. It also performs dynamic scans, emulating the use of the code. As a result of these scans, we get a complete overview of potential exploits and weaknesses. Firstly, the tool identifies where the problems lay in the code. It then provides hints that we can use to resolve each issue. In other words, everything our engineers need to quickly make any required changes.
Types of vulnerability
Insecure Transport is one exploit that Fortify on Demand can identify. This problem occurs when applications use external services over an insecure connection. As a result, hackers can try to intercept or redirect the connection. The solution is simple: we use a protected protocol (for example: FTPS instead of FTP).
A second example is a Resource Leak. This can occur if a connection does not close properly after use. Because servers can only keep a finite number of connections open, hackers can exploit this error. If successful, they can make a server unusable. They can even disable security services designed to block other exploits. Once we identify such an issue, our developers can modify the code to ensure that we close each connection when no longer needed.
A third example? A System Information Leak. This occurs when the web app displays information that contains technical details. Perhaps the database type, operating system or even a username. As a result, this information makes it easier for a hacker to plan an attack on the server. For example, if you know the OS you might already know other weaknesses that you can exploit. Fortify on Demand identifies such dialogs, so our developers can ensure that only essential information is displayed.
These are just simple examples, but by using Fortify to scan our code, our developers can quickly make changes to improve security. And we can then carry out a re-scan to confirm if the change has worked.
Safe and secure software
BSL employs Fortify to scan software such as Pulse. Pulse is a custom news- and alert service, designed and developed by BSL. Pulse indexes and classifies tens of thousands of news articles received each day, in real-time. It provides PwC professionals working throughout Europe with thousands of profiled news feeds. Not only via the company website, but via e-mail and their smartphones. By automatically selecting the best content, Pulse keeps PwC consultants up-to-date with the latest business developments.
Fortify is just one of the tools we have used to verify our Pulse software – which contains many hundreds of thousands of lines of code. It’s probably a sign of our success that Pulse has been in use for more than 7 years, and has never been successfully attacked.
Let BSL keep your users safe
Do you want to find out more about how BSL can keep your users and web applications safe? Just get in touch – no obligation – and we can discuss how to improve the security of your web applications.
