Fortify scours code for security vulnerabilities

The old adage that an ounce of prevention is better than a pound of cure sums up Fortify’s approach to securing homegrown enterprise applications, which are frequently enticing targets for hackers and their malicious exploits. “It’s these front-door apps that are the front-door access to the underlying data,” says Fortify CEO John M. Jack.

The standard approach to securing enterprise applications is to look for attack signatures and then block them. Fortify’s approach is to eliminate the vulnerabilities in the first place, so even if attackers breach network defenses they can’t exploit the applications. “We look at the root cause,” Jack says.

A big reason for the holes in homegrown software is lack of experience. “Most of the applications were written by developers not trained on security. They expect well-behaved users,” Jack says. But now that the enterprise is so connected to the outside world, that expectation is unsupportable.

To help developers eliminate security holes, Fortify offers tools that work with Java, C++, C, and Transact-SQL on Windows and Linux platforms. Essentially an all-purpose plug-in to Borland, Eclipse Foundation, and Microsoft development environments, the Fortify Source Code Analysis tool scans the source code on the build server for vulnerabilities, such as a buffer overflow, that a worm might take advantage of. “There are over a million worms that can exploit that,” Jack says.

Among the other 100 or so vulnerabilities that Fortify looks for are SQL injections and cross-site scripting. The tool identifies the vulnerability so developers can close them while the coding effort is in progress. “We have total knowledge of the app and the context,” Jack says, which he believes results in better security than traditional post-deployment intrusion detection.

For more conventional intrusion prevention, Fortify also provides the Application Defense tool to monitor application attacks. Its primary use is to protect existing applications for which you don’t have the source code or that you have not been able to recode with the help of the Fortify Source Code Analysis tool.

Click for larger view.