LOGIN | REGISTER NOW | SUBSCRIBE
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 3/15/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
ASP.NET MVC 2 Ships
ASP.NET MVC 2 has shipped.
03/12/2010 10:26 AM EST

Microsoft plans 'open' Silverlight analytics framework
Microsoft is going to announce a multipurpose analytics framework for Silverlight at MIX.
03/11/2010 09:51 AM EST

About CSS processing
Two sites that lead to a startling CSS conclusion.
03/10/2010 02:29 AM EST

 

Events calendar tab
SHARE
3/14/2010 to 3/18/2010
Seattle, Wa.
SHARE

Cloud Connect
3/15/2010 to 3/18/2010
Santa Clara, Calif.
TechWeb

Microsoft MIX10
3/15/2010 to 3/17/2010
Las Vegas
Microsoft

SharePointPro Summit & Expo
3/16/2010 to 3/19/2010
Las Vegas
Penton Media

TheServerSide Java Symposium
3/17/2010 to 3/19/2010
Las Vegas
TechTarget


 
print Printable version 
Most Read Latest News Blog Resources
Even with its success, .NET causes some consternation
Despite its popularity, the developer community believes that .NET isn't being fully serve...

VMware releases Tomcat-based server for Spring
SpringSource and VMware are moving their platforms closer together with tc Server for Spri...

Appcelerator dev environment targets Android, iPhone
This unified development environment compiles JavaScript into Objective-C or Java, and wil...

Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter

Cigital releases a set of rules to boost Java security


By Jeff Feinman
September 17, 2008 — 
Application security company Cigital has created a set of Java static analysis rules for Fortify Software’s Source Code Analyzer.

The Java Security Rulepack 1.0, released today, adds 64 vulnerability categories to Fortify’s vulnerability category base, which has more than 315 categories for 17 programming languages, Cigital executives said. The rules in the product are open source, and users can modify the implementation of the rules as they please. This can reduce the number of false positives in an organizational scan, the company said.

Some of the security checks in the Java Security Rulepack include J2EE and Struts misconfiguration checks, cryptographic usage checks, credential protection, and code quality. It works with Fortify's Source Code Analyzer version 4.5 or later.

Among the 64 rules in the Java Security Rulepack are the removal of empty try-catch blocks that handle code; the insurance that cryptographic keys are 128 bits long to maintain the integrity and confidentiality of data; and the avoidance of hard-coding user names and passwords in Castor configuration files.

“We're excited to see outside experts, such as Cigital, writing custom rules to further enhance the level of analysis of Fortify's products,” says Brian Chess, co-founder and chief scientist at Fortify. “This trend started with the Computer Emergency Response Team earlier in 2008, and now takes a great stride forward with the addition of the Cigital Java Security Rulepack.”


Related Search Term(s): Java, open source, security, Cigital, Fortify


Share this link: http://www.sdtimes.com/link/32869
 

Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading