Veracode SecurityReview

New company Veracode has announced their flagship product offering Veracode SecurityReview, an automated, on-demand (vendor hosted) service that allows for the scanning of applications in their binary form without requiring access to the original source code of the application. According to the vendor, such a methodology prevents the need to disclose the actual source code of the tested application or any potential dependent libraries, allowing the service to be targeted both to software development shops as well as any organization who needs to test existing applications, or applications that they are considering purchasing.

As a Web-based service, customers are not required to install any new software or hardware at their site; results of the scans are accessed and managed via a Web interface. Both static and dynamic analyses of applications can be performed, with the vendor noting that multiple testing techniques are utilized and their results correlated in an effort to reduce false positive reports. The appropriate testing techniques are themselves determined via a determination of the application's "Assurance Level," which is based on how critical the application's function is to the business, and what types of data are handled by the application. The scans search both for security vulnerabilities such as embedded (accidentally or intentionally) malicious code and backdoor access; as well as the absence of certain security related features, such as the encryption of data. Results of the tests are prioritized, with recommendations and reports provided on which flaws should be fixed first.

For repetitive testing and remediation cycles, the service additionally assigns a security rating to applications, based both on the results of the application's security analysis and its (the application's) usage. Called the Security Quality Score (Veracode SQS), the rating takes into account the security weaknesses' impact on confidentiality, integrity, and availability of business information as well as environmental parameters such as operating environment, network security, application assurance levels, time-to-fix, and cost-to-fix. The vendor states that their rating system is based on the Common Weakness Enumeration (CWE) from MITRE, and the Common Vulnerability Scoring System (CVSS) from FIRST.

Veracode SecurityReview is offered in three primary flavors: Veracode Enterprise SecurityReview, for the continual analysis of internally developed applications; Veracode Vendor SecurityReview for the analysis of purchased software; and Veracode Partner SecurityReview, targeted to the assessment of partner-developed components.

Contact Veracode for further information.