In far too many designs and implementations, security comes as an afterthought and isn't part of the ongoing development process. Compuware's DevPartner product family is designed to integrate tightly with Visual Studio (and supports Visual Studio.NET 2003 and 2005).
DevPartner includes a SecurityChecker component, which scans ASP.NET application source code to find known security problems. This lets organizations identify insecure coding practices, and pinpoint the method in which (and the line of code on which) such things are detected, using a compile time analyzer to drive scanning, detection, and reporting.
DevPartner Security Checker works through runtime code in three different operational phases:
- Discovery, in which a developer leads the software through a project using manual discovery, or the product performs its own automatic discovery routines to work its way through an entire application on its own.
- Analysis, in which the software displays and issues a high-level graph along with reports of application vulnerability details, including location, description of the vulnerability and related source code, where applicable.
- Advice, in which the software provides detailed remediation advice on how to repair vulnerabilities, including links to additional Web-based information from trusted resources, as well as additional context information around whatever security issues may be involved.
DevPartner Security Checker can even create customized, XML-driven reports to meet your own specifications, for organizations with specific reporting requirements or formatting needs.
The focal elements under DevPartner Security Checker's hood include a compile-time analyzer, a run-time analyzer and an integrity analyzer, each of which operates at different times during the development cycle and helps to provide ongoing security checks throughout the process. The integrity analyzer is really a penetration testing tool that attempts to use known techniques to subvert or compromise existing application code, whereas the other two analyzers scan code at compile time or at run time looking for patterns of code or behavior that match known vulnerabilities.
This tool is available for purchase for Windows XP and Windows 2000 platforms, with Vista support slated for some time in 2007, for a price of $4,200 per named user (includes a one-year update and technical support subscription). Additional discounts for volume purchase are available through Compuware. See the DevPartner Security Checker product page for additional information.
Ed Tittel is a writer and trainer whose interests include XML and development topics, along with IT Certification and information security. E-mail etittel@techtarget.com with comments, questions, or suggested topics or tools to review. Cool tools rule!
