Course Description

Summary

This course provides overall knowledge of the OpenText Fortify Static Code Analyzer technology to secure your source code from vulnerabilities. Show casing the products ability to find, filter, and fix vulnerabilities early in the development lifecycle.

Overview

This course covers the core products Static Code Analyzer (SCA), Software Security Center (SSC), and Audit Workbench; along with OpenText Fortify plugins for IDEs, command-line, and bug tracking. You will learn how to effectively scan sample applications for security vulnerabilities and how to actively audit and remediate the findings.

This course is 75% hands-on exercises, to help you efficiently configure, scan, and audit Static Application Security Testing results. The goal is to enable you to incorporate security early and effectively into your application development lifecycle.

The course focuses on delivering simple, practical steps for using the OpenText Fortify product suite within a lab environment, demonstrating how easy it is to perform static analysis and audit applications for vulnerabilities.

Highlights:

• Software Security Center
• Audit Workbench
• Fortify command-line
• Scan Wizard
• Custom Rulepacks
• IDE Plugins (Eclipse, Visual Studio Code, IntelliJ)
• Bug Tracking (Jira)
• Auditing

Course Objectives

On completion of this course, participants should be able to:

• Use the Static Code Analyzer technology to effectively run scans on application code through Audit Workbench, IDEs, and Command-Line.
• Properly audit the scan results in IDEs, the Software Security Center, and Audit Workbench using filters, Jira bug tracking, Analysis Trace, Smart View, and much more.
• Collaborate scan results, as well as run reports with the Software Security Center, Audit Workbench or your favorite IDE.
• Successfully complete the lessons below in an environment that acts as a production environment.

Audience

This course is designed for security champions, the Analysis Administrators who are responsible for administrating and using OpenText Fortify SAST within their environment; as well as for Developers and Security Auditors who are taking the first steps toward leveraging the power of Static Application Security Testing in their development life cycle.

Prerequisites

This course assumes some familiarity working with OpenText Fortify Static Code Analyzer and Software Security Center, along with basic programming skills, the ability to read Java or .Net, have a basic understanding of web technologies: CI/CD DevOps, plus, have computer, browser, and file system navigation skills.