Micro Focus Fortify and Sonatype Deliver 360 Degree View of Application Security Brochure

Enterprises Need a Holistic View
of Application Security
Micro Focus Fortify Open source use is common and problematic.
and Sonatype Deliver

360-Degree 80% 62% 31%
View of
Application
Security
of application of organizations do not of organizations
code comes from have any control over what experienced a breach
open-source components are used in related to vulnerable
libraries. their applications. open-source components.
Source: 2018 DevSecOps Community Survey, SonaType

Discover the integrated, best-in-class
solution for custom code and open-
source code security vulnerabillities. Open-Source + Custom
Code Vulnerabilities
in a Single Dashboard
Enterprises need to secure not just the code
they write, but also the code they consume from
open-source components. That’s why many are
using Nexus Lifecycle to automate open-source
governance at scale across the entire SDLC,
shifting security left within development and
build stages.
With integration to Fortify, precise open-source

intelligence provides a 360-degree view of
application security issues across the custom
code and open source components.
Open-Source Software Features
Composition Assessments • Provide code once for both SAST and software composition analysis
Third party components make up a significant portion of many applications’ • Supports Java, .NET, JavaScript and Python
codebase, making Software Composition Analysis a “must-have” AppSec • Integrated results deliver one platform for remediation, reporting
capability. Fortify on Demand’s Software Composition Analysis, powered and analytics
by Sonatype, goes beyond a simple comparison of declared dependencies
• Examines fingerprints of 65M components for high accuracy—not just file
against the National Vulnerability Database (NVD). Using natural language
names and package manifests
processing, it dynamically monitors GitHub commits, open-source projects,
advisory websites, Google search alerts, Index, and several vulnerability sites. • Detects 70% more vulnerabilities than the NVD database alone
Additionally, a dedicated team of security experts regularly discovers new • 10M unique vulnerabilities to Sonatype
vulnerabilities and adds them to the proprietary knowledge base. Fortify on
Demand simplifies the onboarding and scanning process by combining static
and composition analysis into a single integration point, whether that’s in the Why Sonatype?
IDE or CI/CD pipeline. The comprehensive bill of materials, including security
vulnerabilities and license details, is delivered as a fully integrated experience 60% of the data that Sonatype ingests comes from public sources like the
for security professionals and developers alike. National Vulnerability Database. Sonatype corrects and curates that public
data augmenting 97% of it to make it more precise. This curation process
involves sophisticated ingestion tools, AI, and machine learning, along with a
Susceptibility Analysis team of 65 Data Security Researchers working nonstop.
Once the solution scans for vulnerabilities, developers or security

professionals can check whether someone has invoked a vulnerability in your Why Micro Focus Fortify?
custom code. More importantly, they can see whether attacker-controlled
input reaches the code’s function. Sonatype research identifies vulnerability The Fortify Software Security Research team translates cutting-edge
signatures containing the method or function responsible for the specific CVE. research into security intelligence that powers the Fortify product portfolio,
And Fortify provides the translation model of the application and the rules including Fortify Static Code Analyzer (SCA), Fortify WebInspect, and Fortify
engine to look for usage or user-controlled input that hits a particular method Application Defender. Today, Micro Focus Fortify Software Security Content
or function. supports 1,032 vulnerability categories across 27 programming languages
This Susceptibility Analysis capability: and spans more than one million individual APIs.
• Reduces known vulnerability false positives.

• Eliminates months of effort upgrading a library that has almost no
security benefit.
• Saves time on investigating known issues in open source.
You’ll avoid the time-consuming headache of auditing vulnerabilities. And
ultimately, more accurate data helps organizations make better decisions
about which vulnerabilities require attention.
microfocus.com | sonatype.com

Micro Focus Fortify and Sonatype Deliver 360 Degree View of Application Security Brochure

Uploaded by

Copyright:

Available Formats

Micro Focus Fortify and Sonatype Deliver 360 Degree View of Application Security Brochure

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Micro Focus Fortify and Sonatype Deliver 360 Degree View of Application Security Brochure

Uploaded by

Copyright:

Available Formats

Enterprises Need a Holistic View

and Sonatype Deliver

Source: 2018 DevSecOps Community Survey, SonaType

With integration to Fortify, precise open-source

Once the solution scans for vulnerabilities, developers or security

• Reduces known vulnerability false positives.

You might also like