LOGIN | REGISTER NOW | SUBSCRIBE
 
print Printable version 
Most Read Latest News Blog Resources
Mono brings .NET to Android
At Microsoft MIX, Mono will unveil the ability to port .NET applications to the Android op...

Does Windows cost Microsoft opportunities?
Microsoft's decision to focus .NET on Windows is stifling innovation due to the specter of...

Maven Studio for Eclipse gets developers up to speed
Sonatype tool simplifies onboarding by giving developers a way to easily deploy fully conf...

Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter

Cigital releases a set of rules to boost Java security


By Jeff Feinman
September 17, 2008 — 
Application security company Cigital has created a set of Java static analysis rules for Fortify Software’s Source Code Analyzer.

The Java Security Rulepack 1.0, released today, adds 64 vulnerability categories to Fortify’s vulnerability category base, which has more than 315 categories for 17 programming languages, Cigital executives said. The rules in the product are open source, and users can modify the implementation of the rules as they please. This can reduce the number of false positives in an organizational scan, the company said.

Some of the security checks in the Java Security Rulepack include J2EE and Struts misconfiguration checks, cryptographic usage checks, credential protection, and code quality. It works with Fortify's Source Code Analyzer version 4.5 or later.

Among the 64 rules in the Java Security Rulepack are the removal of empty try-catch blocks that handle code; the insurance that cryptographic keys are 128 bits long to maintain the integrity and confidentiality of data; and the avoidance of hard-coding user names and passwords in Castor configuration files.

“We're excited to see outside experts, such as Cigital, writing custom rules to further enhance the level of analysis of Fortify's products,” says Brian Chess, co-founder and chief scientist at Fortify. “This trend started with the Computer Emergency Response Team earlier in 2008, and now takes a great stride forward with the addition of the Cigital Java Security Rulepack.”


Related Search Term(s): Java, open source, security, Cigital, Fortify


Share this link: http://www.sdtimes.com/link/32869
 

Add comment


Name*
Email*  
Country     


  • Comment
  • Preview
Loading



 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 
Download Current Issue
ISSUE 3/15/2010 PDF

Need Back Issues?
DOWNLOAD HERE

Receive the print Edition?


 
blogs tab
Google Code turns 5
Google Code Turns 5, and adds a Paxos Algorithm to make the system more stable and reliable.
03/17/2010 11:16 AM EST

Test your Visual Studio 2010 know-how
Microsoft is offering free beta certification exams for Visual Studio 2010.
03/17/2010 11:08 AM EST

Microsoft lifts the hood on IE9
Microsoft is previewing IE9.
03/16/2010 01:10 PM EST

 

Events calendar tab
EclipseCon
3/22/2010 to 3/25/2010
Santa Clara, Calif.
The Eclipse Foundation

DevConnections
4/12/2010 to 4/14/2010
Las Vegas
Penton Media

MySQL Conf. and Expo
4/12/2010 to 4/15/2010
Santa Clara, Calif.
O'Reilly Media

High Performance Computing Linux Financial Markets
4/19/2010
New York City
Flagg Management

Informix User Conf.
4/25/2010 to 4/28/2010
Overland Park, Kans.
IIUG