The Fortify offering is a software-based solution which is also a
CASE (computer aided software engineering) utility. Any source code can
be reviewed with the Source Code Analysis (SCA) suite. This ties tightly to
the PCI-DSS standards, which require code reviews, and also should be
part of a SDLC (system development life cycle). The use of source code
analysis is, of course, the best way to spot flaws and, unlike most of
the products we tested, is not a black box test.
Source Code Analysis (SCA) suite supports many languages — including
ASP.NET, C/C++, C#, ColdFusion, Java, JSP, PL/SQL, T-SQL, XML, VB.NET
and other .NET languages. Source Code Analysis (SCA) suite also supports
several development environments, such as Microsoft Visual Studio,
Eclipse, WebSphere Application Developer and IBM Rational Application
Developer. Source Code Analysis (SCA) suite can be installed on a variety of
operating systems, including Windows, Mac, Solaris, Linux, AIX and HPUX.
The installation of the suite was simple and the utility
automatically downloads updates during part of the installation
process. The process was a bit time-consuming as the process configured
the system. The application installation performs most of the
configuration without the need for user intervention. All in all, the
installation process was among the simplest in this Group Test.
The suite arrived with a guide for the initial installation in hard
copy. A PDF version of the document is also available. The PDF files
are not indexed and searchable, so the PDF needs to be scanned
manually.
Support is offered through phone and a password-protected web
portal, and also through email. In addition, the standard price allows
for quarterly updates for the latest security tests for code review.
Phone support is available 6 a.m. to 6 p.m. Pacific Standard Time.
The pricing for Source Code Analysis Suite is $1,200 per developer.
This prices Source Code Analysis (SCA) suite at the low end of the spectrum.
For a feature rich CASE environment, this price is definitely a value.