HPE Fortify - Secure Code Analysis

Identify Fortify 45 system requirements, including minimum 8 GB RAM (16 GB recommended, 32 GB server), supported Windows, Linux, and macOS, and compatible build tools and plugins.

Install Fortify SCA by selecting the installation directory, license, and needed plugins. Launch Fortify Workbench to manage rules, view the Fortify project report, and complete post-install updates and migration options.

Execute a basic Fortify audit workbench scan to generate an fpr report, selecting Java version 1.8 and customizing issue and code-quality filters in the GUI.

Explore advanced scan in audit workbench by configuring folders, classpath directories, and build format, manage warnings and fpr output, and tune memory and quick scan mode for efficient scanning.

Review the Fortify project report (FPR) in the auditor view, examining critical, high, medium, and low issues with analysis evidence, and group by category to prioritize remediation.

Explore the scan wizard in Fortify, configure a project root, select languages, enable build integration, and generate a batch file to run a secure code analysis with verbose output.

Learn how to run a command line scan with sourceanalyzer in Fortify, generate an fpr report, and interpret findings like cross-site scripting, open redirect, and privacy issues.

Install the fortify plugin for Visual Studio after installing and closing the IDE, then run the wizard to update and enable analyze, collaborate, and audit projects with the complete package.

Install the Fortify plugin in Visual Studio, scan a dotnet solution to generate an FPR, and set ASP pre-compilation to false in Fortify properties to avoid errors.

Learn to interpret Fortify's FPR results, switch to security audit view, and triage findings from insecure transport, path manipulation, and XSS with encryption and input validation recommendations.

Explore the software security center overview, a deployable web server with Apache, LDAP, and FPR uploads that enables vulnerability tracking and risk management through a comprehensive dashboard.

Explore fpr analysis of a Java application, identifying critical vulnerabilities such as cross-site scripting, sql injection, and path manipulation, and how to mark issues as exploitable or suspicious.

Analyze high findings in secure code analysis, including access control, file disclosure, header manipulation, server side request forgery, and reliability issues to strengthen application security.

Analyze medium issues like xml entity expansion injection due to missing doctype restrictions, and examine low severity concerns from sql injection risks, csrf, javascript hijacking, and missing null checks.

Review and categorize remaining low issues in secure code analysis, covering null checks, XML validation, password management, error handling, logging, and cryptographic hashing, with actionable recommendations.

Walks through critical and high severity issues in Fortify secure code analysis, detailing cross-site scripting, dangerous file inclusion, open redirects, and external entity injection with practical examples.

Explore the details and recommendations tabs for medium and low Fortify vulnerabilities, reading code-level mitigations and examples to perform effective code reviews and secure fixes.