HP is announcing the first upgrade to Web-application security-testing software it acquired last year with the purchase of SPI Dynamics.
The HP security-assurance suite has three components: DevInspect for checking the integrity of code, QAInspect for testing whether discovered flaws have been corrected, and WebInspect for testing whether Web applications operate as intended. HP has upgraded all three.
The vendor faces competition in this area from Breach Security, WhiteHat Security and IBM’s Watchfire, among others.
These tools can save time when trying to assure that code is secure, says Christopher Rence, CIO of financial-services firm Fair Isaac. “We’re doing the [quality assurance] upfront while we’re writing the code, basically saving us time. We’re able to say we’ve run this through QA, so as the code comes out, we’re not having to go back and regression-test it,” he says.
DevInspect has been upgraded to improve the interaction of its static and dynamic analysis of software it tests. Static analysis seeks what may be vulnerabilities, while dynamic analysis tests those potential vulnerabilities to see whether they are exploitable. The purpose of using both static and dynamic analysis is that static can find flaws but not say whether they need to be fixed.
DevInspect already combined static and dynamic analysis, but the new version performs more-definitive static analysis, making it possible to know for sure that a vulnerability exists.
QAInspect now includes tools to track how discovered defects in code are being addressed to meet the requirements of such industry standards as the Payment Card Industry’s Data Security Standard, and creates a workflow map to make sure they get done.
WebInspect now tests Web applications and their use of Ajax, Java, Javascript and flash by emulating a browser to analyze how these scripts run inside it.
The security-assurance suite is expected to be available in August. It will be offered via HP Software-as-a-Service and include consulting from HP’s services group.
