Software Security Assessment Tool Review - Revision history

M. Buchanan at 22:06, 17 February 2012

2012-02-17T22:06:48Z

M. Buchanan at 22:00, 17 February 2012

2012-02-17T22:00:02Z

M. Buchanan at 21:50, 17 February 2012

2012-02-17T21:50:43Z

Show changes

M. Buchanan at 21:41, 17 February 2012

2012-02-17T21:41:46Z

M. Buchanan at 21:40, 17 February 2012

2012-02-17T21:40:11Z

Show changes

M. Buchanan at 21:37, 17 February 2012

2012-02-17T21:37:09Z

Show changes

M. Buchanan at 19:08, 16 February 2012

2012-02-16T19:08:55Z

M. Buchanan: Created page with "==SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A: TOOL MATRIX== {| width="80%" border="2" cellspacing="2" cellpadding="2" |+ '''APPENDIX TEMPLATE''' |- valign="top" | ..."

2012-02-16T19:08:19Z

Created page with "==SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A: TOOL MATRIX== {| width="80%" border="2" cellspacing="2" cellpadding="2" |+ '''APPENDIX TEMPLATE''' |- valign="top" | ..."

New page

==SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A: TOOL MATRIX==

{| width="80%" border="2" cellspacing="2" cellpadding="2"
|+ '''APPENDIX TEMPLATE'''
|- valign="top"
| width="40%" style="background: #FFCC99" | '''Product'''
| width="40%" style="background: #FFCC99" |
|- valign="top"
| style="background: #FFCC99" | '''Description'''
| style="background: #FFCC99" |
|- valign="top"
| style="background: #FFCC99" | '''URL'''
| style="background: #FFCC99" |
|- valign="top"
| style="background: #CCFFFF" | '''Supported Languages'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Supported Platforms Where Tool Runs'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Supported Platform Where Target Resides'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Supported Compilers '''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Can Tool be used Remotely?'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Finds or Checks for: (Tool Category)'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Lifecycle Position(s)'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Scalability (Ability to scan up to 1,000,000 LOC?)'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability to Identify Comments in Code'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability to Discover Debug Code'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability to Discover Unused Code'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Tool uses CWE Definitions of Vulnerabilities'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Frequency of Rule Base Updates by Tool Provider '''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability of Testers to Modify Existing Rule Bases '''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability of Testers to Add New Rule Bases'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Ability to provide suggestions for mitigating vulnerabilities (Remediation). If able, is it Active or Passive?'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #CCFFFF" | '''Cost (Hourly/ Flat Fee) [AVAILABILITY]'''
| style="background: #CCFFFF" |
|- valign="top"
| style="background: #FFFF99" | '''Licensing'''
| style="background: #FFFF99" |
|- valign="top"
| style="background: #FFFF99" | '''Vendor Technical Support'''
| style="background: #FFFF99" |
|- valign="top"
| style="background: #FFFF99" | '''Vendor Services / Professional services support'''
| style="background: #FFFF99" |
|- valign="top"
| style="background: #FFFF99" | '''Required training or experience level to operate'''
| style="background: #FFFF99" |
|- valign="top"
| style="background: #FFFF99" | '''Vendor provided (or 3rd party provided) training available'''
| style="background: #FFFF99" |
|- valign="top"
| style="background: #FFFF99" | '''Comments'''
| style="background: #FFFF99" |
|}

@@ Line 1: / Line 1: @@
 The OWASP Software Security Assessment and Testing Tools Profiles Project will create a Wiki of current, directly comparable, unbiased information about commercial and open source Software Security Assessment and Testing Tools. Tool descriptions and evaluations exist elsewhere online and offline, e.g., Wikipedia and the NIST SAMATE portal, including the 2008 Naval Ordnance Safety & Security Activity Software Security Assessment Tools Review on the SAMATE portal. On Wikipedia, the quantity and quality of information varies widely due to lack of a standard template for capturing tool information. Government sources are often obsolete by the time they are published, and are seldom updated. Other sources provide different types of information, which is often biased.
 The OWASP tools Profiles differ from other sources by providing a standard set of information about each tool, allowing for direct comparisons between tools. The initial Profiles are wiki versions of the NOSSA tool descriptions, which we recognize are outdated. The wiki format enables the tool's developer, users, and other stakeholders to easily review and revise/update the information, and the Profile template also includes a field for adding non-standard information. A blank Profile wiki template is also provided for creating new tool Profiles. The tool Profiles will also be updated to add information from SAMATE's source code analyzer descriptions, with the Profile template expanded with new information categories if necessary. The wiki format will also allow for future expansion of the Project to cover other types of software/application security tools.
@@ Line 7: / Line 6: @@
 [[SSATR Template]] use this template to add another tool
-===Appendix A-2===
+==Appendix A-2==
 {| width="80%" border="2" cellspacing="2" cellpadding="2"
 |+ '''SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A-2'''
@@ Line 90: / Line 89: @@
 |}
-===Appendix A-3===
+==Appendix A-3==
 {| width="80%" border="2" cellspacing="2" cellpadding="2"
 |+ '''SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A-3'''
@@ Line 172: / Line 171: @@
 | style="background: #FFFF99" |
 |}
-===APPENDIX A-4===
+==APPENDIX A-4==
 {| width="80%" border="2" cellspacing="2" cellpadding="2"
 |+ '''SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A-4'''
@@ Line 254: / Line 253: @@
 | style="background: #FFFF99" |
 |}
-===APPENDIX A-5===
+==APPENDIX A-5===
 {| width="80%" border="2" cellspacing="2" cellpadding="2"
 |+ '''SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A-5'''

@@ Line 825: / Line 825: @@
 | style="background: #FFFF99" | '''Vendor provided (or 3rd party provided) training available'''
 | style="background: #FFFF99" | Yes
 |- valign="top"
 | style="background: #FFFF99" | '''Comments'''
 | style="background: #FFFF99" |
 |}

@@ Line 746: / Line 746: @@
 | style="background: #FFFF99" | '''Comments'''
 | style="background: #FFFF99" | The product is designed to minimize false positives.
 |}

@@ Line 1: / Line 1: @@
-==SOFTWARE SECURITY ASSESSMENT TOOLS REVIEW: APPENDIX A: TOOL MATRIX==
 {| width="80%" border="2" cellspacing="2" cellpadding="2"
-|+ '''APPENDIX TEMPLATE'''
+|+ '''APPENDIX A: TOOL MATRIX TEMPLATE'''
 |- valign="top"
 | width="40%" style="background: #FFCC99" | '''Product'''