You are here

InfoWatch Attack Killer - Custom Code Scanner

 

InfoWatch Attack Killer Custom Code Scanner (CCS) detects application vulnerabilities, using source code analysis.

 

KEY FEATURES

Adapting to application specifics
InfoWatch Attack Killer CCS users can add custom templates to the database of irregular programming constructs in order to cope with the specifics of corporate business processes.

SDL best practices
During source code analysis, InfoWatch Attack Killer CCS supervises the compliance with PCI DSS and HIPPA, Information Security Standard-1.0-2014 for the Russian Banking System Organizations by the Central Bank of Russia, CERT and OWASP best practices, recommendations from SDLC and platform vendors.

Ease of use
For code analysis, it is merely required to set up the process of application code or its fragment uploading to InfoWatch Attack Killer Custom Code Scanner. The scanner's output will be automatically shown in bug tracking system as a fix task. Until fixed by programmers, vulnerability queries are blocked by WAF.

 

ADVANTAGES

Supporting all popular programming languages
InfoWatch Custom Code Scanner supports over 20 common programming languages: PHP, Java, C#, JavaScript, Python, Ruby and others. If requested, InfoWatch can add a new language within three months.

Minimizing false positives
Dynamic scanning verifies assumed vulnerabilities and thus drops the number of false positives virtually to zero, with confirmation exploits being released for the discovered security holes.

Convenient code quality control
Users of InfoWatch Attack Killer CCS are free to set any source code scanning frequency that fits their needs: for example, event-based (once repository is updated) or scheduled (a particular day of the week). Moreover, the system can scan on demand (for example, for reporting to external auditors). In addition, the reports have an auditor-friendly format.

Easier PCI DSS certification
InfoWatch Attack Killer CCS makes software development compliant with Clause 6.5, PCI DSS.

 

SYNERGY WITH INFOWATCH ATTACK KILLER WEB APPLICATION FIREWALL

  • InfoWatch Attack Killer Custom Code Scanner (CCS) detects application code vulnerabilities and sends the collected data to WAF for mitigation measures to be taken.
  • In the bulk of security events, the integration of CCS and WAF helps identify only those attack vectors that can turn into real incidents and confirm them by releasing exploits.
  • Detected through static and dynamic analysis, critical vulnerabilities are automatically fixed by virtual patches.

The use of CCS and WAF in parallel builds effective and automated in-house security development lifecycle (SDL) and enhances the security of business-critical resources: websites and more sophisticated web apps.