IBM Improves Security Analytics For Development Teams

IBM has tapped its Rational Software tools division to deliver software that advances security analysis. New software analysis capabilities provide a more efficient and accurate way to help organisations design, build and manage secure applications, the company said.

The offering, based on software IBM received through its acquisition of Ounce Labs, consolidates software vulnerability analysis and reporting into a single view across the enterprise. This allows developers to assess security threats across the entire software development lifecycle, enabling global teams to easily identify and test security exposures and help reduce the risks and costs associated with security and compliance concerns, IBM said.

For example, organisations can use the software to automate application security audits and source code scanning to ensure that the network and Web-based applications are secure and compliant. The company claims this delivers improved accuracy of vulnerability identification and remediation.

Automatic String Analysis

The added security offerings include enhancements to the IBM Rational AppScan portfolio that simplify security vulnerability analysis and identification for software developers, IBM said. Moreover, as part of the new features, IBM Research provided string analysis, a capability that helps the security testing process by automatically detecting and verifying which Web application development input needs to be cleansed to remove security risks. This helps accelerate the accuracy and efficiency of security testing by the development community, regardless of their security expertise.

According to IBM’s 2010 mid-year X-Force Trend Report, 55 percent of all vulnerabilities come from Web applications, making it the greatest source of risk for organisations. The research indicates that computer security threats rose by 36 percent in the first half of 2010, resulting in more than 4,000 new vulnerabilities being documented compared to last year.

Web applications are often vulnerable due to a lack of built-in security. To reduce these risks, organisations need to implement security strategies that ensure applications are designed securely across the entire development lifecycle, from start to finish, IBM said in a press release. Finding ways to extend security analysis across more testers in the security process and employing multiple testing techniques should result in higher-quality and more secure applications

“As vulnerabilities become more prevalent, testing across the entire development lifecycle without having to invest in additional development resources and skills is significant for the bottom line,” said Steve Robinson, general manager of IBM Security Solutions. “Through the ongoing value brought by the acquisitions of Ounce Labs and Watchfire, combined with our R&D expertise, we can now provide more comprehensive security governance, collaboration and risk management solutions that further protect organisations from malicious attacks.”

Meanwhile, the new advancements in the IBM Rational AppScan portfolio simplify and automate security scanning with new hybrid analysis capabilities, improving vulnerability identification and remediation. The hybrid analysis provides automated correlation of results from static code and dynamic analysis to increase vulnerability identification in automated software.

Enhancements to the IBM Rational AppScan portfolio include a consolidated view of vulnerabilities with hybrid analysis reporting, broader scanning access to identify blind spots, a simplified security assessment process, and support for multiple frameworks.

In addition, IBM announced support for federal security protocol, CAC/PKI, for the IBM Rational Software portfolio. The CAC/PKI protocol enhances the ability of governments to prevent unauthorised access to physical and digital environments, compromising the security of military and national initiatives. IBM provides a full range of services for the detailed design, development and implementation of smartcard/biometrics and CAC/PKI implementations as part of the efforts to deliver full software lifecycle support of CAC/PKI and other security protocols.