What We Learned from Studying 36,000 OSS Projects | Press Release

blog-logo Sonatype Blog

New Micro Focus, Sonatype Partnership Provides 360 Degree View of AppSec

September 11, 2019 By Michelle Dufty

In today’s world, we know that most security breaches occur because of application vulnerabilities. We also know that most typical software applications are, on average, comprised of 85% open source software. These facts are changing the way enterprises are thinking about security overall, and makes open source libraries a critical dimension of any serious application security initiative. 

The need to understand both custom and open source code, in a holistic way, is exactly why Micro Focus and Sonatype are coming together in partnership and powering a best-in-class, fully integrated application security platform for all Fortify customers.  

This new partnership, which promotes Sonatype as Fortify's preferred Software Composition Analysis (SCA) partner, delivers Micro Focus’s Fortify on Demand or Premise (Fortify SSC) customers the advantages of a single, fully integrated application security platform, without compromising depth and capability in managing open source risk and vulnerabilities. 

SCA Data rolled up into the dashboard in Fortify on Demand

SCA Data rolled up into the dashboard in Fortify on Demand

 

Picture2-5

(Global SCA view in Fortify on Demand) 

Application Security as a Service

Fortify software composition analysis, now powered by Sonatype, provides Micro Focus customers with greatly expanded SCA coverage. Sonatype uses artificial intelligence, machine learning, and human curation to identify open source software security vulnerabilities. This significantly expands component intelligence in depth and breadth beyond name matching files listed in the NVD (National Vulnerability Database). Sonatype’s SCA platform is continuously updated as open source projects, GitHub commits, advisory websites, and other vulnerability sources are examined. Security monitoring is ongoing and automatic.

Benefits for Dev and Sec 

Fortify simplifies the onboarding and scanning process by combining static and composition analysis into a single integration point, whether that's in the IDE or CI/CD pipeline. The comprehensive software bill-of-materials, including security vulnerabilities and license details, is delivered as a fully integrated experience for security professionals and developers alike.

Key features and updates include:

  • Simultaneously run SAST and SCA analysis
  • Supports Java, .NET, JavaScript and Python
  • Integrated results deliver one platform for remediation, reporting and analytics
  • Examines fingerprints of over 65 million components - not file names and package manifests
  • Detects 70% more vulnerabilities than the NVD database alone

Get an inside look at how to use Sonatype’s open source security capability with Micro Focus Fortify below: 

 

Tags: AppSec, devsecops, Fortify, micro focus, Product, Post security/devsecops

Written by Michelle Dufty

Michelle Dufty is the Senior Director of Product Marketing at Sonatype where she brings solutions to market that unite development, security, and operations teams to accelerate software innovation while minimizing open source risk.