Page Comparison

...

Expand

When a Security Vulnerability is detected, a number of detailed Attributes is provided.

See this video:

VIdeo SR AT1-AT15 2020-09-09 at 08.12.22.mp4

Legend:

Attribute	Field	Description
AT1	Vuln ID	Vulnerability Unique Identifier
AT2	Component	Component Name and Version
AT3	File	Vulnerable file pathname, Class and Method (Program and Perform in COBOL)
AT4	Line of code	Vulnerable Line inside the File
AT5	Description	Vulnerability Description (includes external documentation and known attack vectors links)
AT6	Category	Vulnerability Category
AT7	Standard	Compliance/Best Practice International Standard (OWASP, CWE, CVE, WASC, PCI-DSS)
AT8	Rule	Unique Identifier and Description of violated Rule
AT9	CVSS	Value related to Common Vulnerability Scoring System CVSS V3.1
AT10	Severity	Blocker (Very High), Critical (High), Major (Medium), Minor (Low), Info (Very Low)
AT11	Code Snippet	Source code lines surrounding the vulnerabile one
AT12	Status	‘Confirmed’ means True Vulnerable, ‘Not An Issue’ means False Positive. Other values like ‘Not Exploitable’ are available, in compliance to international standards
AT13	Remediation Tip	Short suggestion tip for vulnerability fixing
AT14	Application	Analyzed Application Name
AT15	Version	Analyzed Application Version
AT16	Responsible	Team responsible of remediation
	Outsourcer	Outsourcer contributing to remediation
AT17	Priority	Number ranging from 1 (Urgent) to 5 (Cosmetic) representing vulnerability fixing Priority

Q. Can Static Analysis provide per-component results?

Before executing the Static Analysis, source code may be grouped by Components, via Component Builder feature. Results by Component, Outsourcer and/or Development Team can be associated, as well as the related Application Portfolio ID and Project Initiative

Q. When Analysis ends, is there a notification service?

At Analysis termination, an e-mail can be sent to a single target address and/or a mail group using your own SMTP server. Notifications can be also made using Slack, Microsoft Teams or sent to any Platform with WebHooks support. See Ecosystem for further details.

Q. Which Analysis results output formats are supported?

Results are exported in customizable PDF, Word, Excel, HTML, CSV, JSON and XML formats. Reports can be customized with ISO 9001 cover page, your logo, Classification and your Responsability Chain.

Q. May I suppress a vulnerability?

Yes, you can mark a vulnerability as False Positive, insert Notes and Vulnerability Status, all associated to a specific author. Those information will used in the next Analysis and included in the reports. See False Positives and False Negatives

Q. In Static Analysis, may I create custom Security Rules?

You can exclude some Security Rules from the Static Analysis, between the ones available, or you can create new Security Rules using the Cigital Secure Assist standard. Those rules can be associated to a specific analysis or to a single Application or Group of applications

Q. Which Development IDE are supported?

Currently, Eclipse, NetBeans, Visual Studio, Visual Studio Code, IBM Rational Team Concert, Rational Software Architect, Rational RAD Studio, JetBrains IntelliJ IDEA, RubyMine, WebStorm, PhpStorm, PyCharm, AppCode and Android Studio plugins are available. See IDE Plugins

...

Expand

Malware is detected using an embedded version of Metaesploit against our own collection of rules, as well as through Dynamic analysis of ELF files:

Starting and Termination: Time Stamps and Elapsed Time.
Processes Information: clone, execve and exit etc.
File I/O: open, read, write and delete etc.
Network: TCP, UDP, HTTP and HTTPS etc.
Typical Malicious Actions: self deletion, modification and lock.
API Information: getpid, system, dup and other libc functions.
syscall sequences.

Further, our Dynamic Analysis finds Backdoors based in: Suspicious open TCP ports, suspicious connection to external IPs and URIs, presence of Non-standard services and Suspicious executables.

...

Versions Compared

Old Version 78

New Version 79

Key