SAST with Fortify SCA: Scanning in an IDE

A demo of using Fortify Static Code Analyzer (SCA) to scan in an IDE.

Fortify Static Code Analyzer (SCA) is the industry-leading SAST (static application security testing) tool. This on-premises tool also powers Fortify on Demand for Fortify on Demand (FoD), which is a complete application security as-a-service (AppSec SaaS) solution with SAST, DAST, IAST, RASP, SCA (open source security), and developer security training.

There are several ways to perform scans using Fortify SCA.
1. From the CLI (command-line interface) or Script that use Source Analyzer
2. From the CLI or Script that use ScanCentral
3. Within a supported IDE (integrated development environment) (this video)
4. As part of a CI Pipeline

This video is part 2 of a series showing each of these methods.

What you can do in a supported IDE with Fortify.
1. Initiate a scan
- performed within the environment
- scan settings can be configured
- manual process
2. View results
- issues grouped into Critical/High/Medium/Low buckets
- issues can be grouped in multiple ways
- view issue details and remediation guidance
- generate reports (some IDEs)
3. Audit results
- add comments to audit history
- raise bug tickets (some IDEs)
- upload results to Fortify Software Security Center (SSC)
- Audit SSC-based results in IDE
4. Fortify Security Assistant
- supports Visual Studio and Eclipse
- plugin finds a subset of issues as developers write their code

- Connect with peers and share your knowledge
- Find solutions and answers to your technical questions
- Stay informed on new releases and product enhancements
- Access downloads, demos, videos and support tips

[jorgepinzon]

Login credential? I don´t understand, please help me.

[chenyi]

Why don't you disclosure intellij remedation plugin download link? ?My plugin is too old to compatible with new intellij idea, and I don't want to ask to the man who have fortify official website account in my company for just this little thing.