Dockerfile Scanning with Fortify SCA

Demo of Dockerfile Scanning with Fortify Static Code Analyzer (SCA), new with release 20.2 (Nov 2020).

Scanning of Docker Config files
- Help developers create more secure container images as part of the SDL
- Complements scanning base images for known vulnerabilities
- Supports custom rules for use cases such as verifying use of company approved base images
- Dockerfiles in 20.2 (6 vulnerability categories)
- Docker Compose, K8 Helm Charts and Infrastructure as Code in future releases
- Based on CIS Benchmark

Fortify Static Code Analyzer (SCA)—Build Better Code and Secure Your Software
Fortify SCA is an automated static testing offering that builds security into the development process. Fortify SCA pinpoints the root cause of the vulnerability and prioritizes results, and provides best practices so developers can code more securely. It reviews code and helps developers identify and resolve issues with less effort and in less time.

- Connect with peers and share your knowledge
- Find solutions and answers to your technical questions
- Stay informed on new releases and product enhancements
- Access downloads, demos, videos and support tips

[AnmolSingh-drsu]

When I execute "sourceanalyzer -b docker . -verbose", I get

"[error]: No valid input files were specified. (Use the -scan option to analyze previously-built sources.)"