{"id":29283,"date":"2025-05-19T11:20:04","date_gmt":"2025-05-19T11:20:04","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=29283"},"modified":"2025-05-19T11:20:04","modified_gmt":"2025-05-19T11:20:04","slug":"what-is-fortify-and-how-it-works-an-overview-and-its-use-cases","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/what-is-fortify-and-how-it-works-an-overview-and-its-use-cases\/","title":{"rendered":"What is Fortify and How it works? An Overview and Its Use Cases"},"content":{"rendered":"\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udee1\ufe0f What is <strong>Fortify<\/strong>?<\/h1>\n\n\n\n<p><strong>Fortify<\/strong> is a <strong>Static Application Security Testing (SAST)<\/strong> tool developed by <strong>Micro Focus (now part of OpenText)<\/strong>. It helps <strong>developers and security teams<\/strong> identify vulnerabilities <strong>early in the software development life cycle<\/strong> (SDLC) by <strong>scanning source code<\/strong> for security issues \u2014 <em>before<\/em> the application is ever run.<\/p>\n\n\n\n<p>It\u2019s trusted by enterprises that care about <strong>secure coding<\/strong>, <strong>compliance (like OWASP Top 10, PCI-DSS)<\/strong>, and <strong>DevSecOps best practices<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd0d How Fortify Works \u2013 The Human Way<\/h1>\n\n\n\n<p>Let\u2019s say you&#8217;re writing code for a web application. It compiles, runs fine, and passes functional tests. But is it <strong>secure<\/strong>?<\/p>\n\n\n\n<p>This is where Fortify steps in.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83e\udde0 Step-by-Step Breakdown<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Step 1: <strong>You write your code<\/strong><\/h4>\n\n\n\n<p>Fortify supports many languages \u2014 Java, Python, JavaScript, C\/C++, .NET, PHP, etc.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 2: <strong>You run a scan using Fortify Static Code Analyzer (SCA)<\/strong><\/h4>\n\n\n\n<p>Fortify reads your source code line-by-line <strong>without executing it<\/strong> and tries to simulate how the app would behave. Think of it like a super-powered code reviewer who\u2019s read every security rulebook out there.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 3: <strong>Fortify builds an Abstract Syntax Tree (AST)<\/strong><\/h4>\n\n\n\n<p>It builds a map of your code structure, then analyzes control flow (how the code executes) and data flow (how data moves across the code).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Step 4: <strong>Security Rules are Applied<\/strong><\/h4>\n\n\n\n<p>Fortify has a huge library of security rules (covering OWASP, SANS, etc.). It checks for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SQL Injection<\/li>\n\n\n\n<li>Cross-Site Scripting (XSS)<\/li>\n\n\n\n<li>Insecure cryptographic storage<\/li>\n\n\n\n<li>Broken authentication<\/li>\n\n\n\n<li>Command injection<\/li>\n\n\n\n<li>And many more\u2026<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Step 5: <strong>Scan Results are Generated<\/strong><\/h4>\n\n\n\n<p>You get a detailed report:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vulnerability name<\/li>\n\n\n\n<li>File + line number<\/li>\n\n\n\n<li>Severity level (High, Medium, Low)<\/li>\n\n\n\n<li>Suggested remediation<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Step 6: <strong>You fix the issues<\/strong><\/h4>\n\n\n\n<p>Based on recommendations, you secure your code.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\u2699\ufe0f Fortify Architecture (Quick Overview)<\/h1>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">Your Source Code\n      \u2193\nFortify <span class=\"hljs-keyword\">Static<\/span> Code Analyzer (SCA)\n      \u2193\n&#91;Intermediate Format (.fpr file)]\n      \u2193\nFortify Software Security Center (SSC) \u2013 Dashboard + Collaboration\n      \u2193\nVisual Studio \/ Eclipse Plugins <span class=\"hljs-keyword\">or<\/span> Web UI\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd27 How to Use Fortify \u2013 Beginner Tutorial<\/h1>\n\n\n\n<p>Let\u2019s walk through how <strong>you can run Fortify in your project locally<\/strong> using CLI.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\ud83d\udda5\ufe0f Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Java JDK 11+<\/li>\n\n\n\n<li>Fortify SCA (installed on your machine)<\/li>\n\n\n\n<li>Project source code (Java\/PHP\/.NET etc.)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\u2705 Step 1: <strong>Initialize the Scan<\/strong><\/h3>\n\n\n\n<p>From your source folder:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">sourceanalyzer -b myProject -clean\n<\/code><\/span><\/pre>\n\n\n<p>This creates a <strong>new scan session<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\u2705 Step 2: <strong>Scan Your Code<\/strong><\/h3>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-tag\">sourceanalyzer<\/span> <span class=\"hljs-selector-tag\">-b<\/span> <span class=\"hljs-selector-tag\">myProject<\/span> <span class=\"hljs-selector-tag\">-scan<\/span> <span class=\"hljs-selector-tag\">-f<\/span> <span class=\"hljs-selector-tag\">myProject<\/span><span class=\"hljs-selector-class\">.fpr<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>This:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scans the code<\/li>\n\n\n\n<li>Produces a <code>.fpr<\/code> (Fortify Project Results) file<\/li>\n\n\n\n<li>Which you can later upload to SSC or view locally<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">\u2705 Step 3: <strong>View Results<\/strong><\/h3>\n\n\n\n<p>You can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open <code>.fpr<\/code> in Fortify Audit Workbench (GUI tool)<\/li>\n\n\n\n<li>Or upload it to <strong>Fortify Software Security Center (SSC)<\/strong> for centralized dashboards and team collaboration<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\ude80 Use Cases for Fortify<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Use Case<\/th><th>Description<\/th><\/tr><\/thead><tbody><tr><td>\u2705 <strong>Secure Code Reviews<\/strong><\/td><td>Automates review to catch what manual eyes miss<\/td><\/tr><tr><td>\ud83c\udfe2 <strong>Enterprise DevSecOps<\/strong><\/td><td>Integrate into CI\/CD (Jenkins, GitLab, Azure DevOps)<\/td><\/tr><tr><td>\ud83c\udfdb\ufe0f <strong>Regulatory Compliance<\/strong><\/td><td>Ensures code aligns with OWASP, NIST, PCI-DSS, HIPAA<\/td><\/tr><tr><td>\ud83e\uddea <strong>Shift-Left Testing<\/strong><\/td><td>Finds issues early (and cheaply!) in development<\/td><\/tr><tr><td>\ud83e\uddd1\u200d\ud83d\udcbb <strong>Developer Training<\/strong><\/td><td>Helps devs learn secure coding via issue explanations<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd04 Fortify in DevSecOps CI\/CD Pipeline<\/h1>\n\n\n\n<p>Here\u2019s how it fits in a DevOps pipeline:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-attr\">&#91;Code Push]<\/span>\n   \u2193\n<span class=\"hljs-selector-attr\">&#91;GitLab \/ GitHub \/ Jenkins]<\/span>\n   \u2193\n<span class=\"hljs-selector-attr\">&#91;Fortify SCA Scan in CI Job]<\/span>\n   \u2193\n<span class=\"hljs-selector-attr\">&#91;Push .fpr to Fortify SSC]<\/span>\n   \u2193\n<span class=\"hljs-selector-attr\">&#91;Dashboard \/ Email Alerts]<\/span>\n   \u2193\n<span class=\"hljs-selector-attr\">&#91;Developer Fixes and Re-Scans]<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>You can configure this as a blocking gate before deployment to production.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udccc Tips for Best Use<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start small: scan critical modules first.<\/li>\n\n\n\n<li>Automate in CI\/CD for consistent scans.<\/li>\n\n\n\n<li>Use SSC or Audit Workbench to triage and assign issues.<\/li>\n\n\n\n<li>Tune false positives over time using <strong>Fortify Rulepacks<\/strong> or <strong>custom rules<\/strong>.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83e\uddd1\u200d\ud83c\udf93 Who Uses Fortify?<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Banking &amp; Financial Services<\/strong>: for PCI-DSS &amp; fraud prevention<\/li>\n\n\n\n<li><strong>Healthcare<\/strong>: HIPAA-aligned secure software<\/li>\n\n\n\n<li><strong>Government<\/strong>: secure code for sensitive apps<\/li>\n\n\n\n<li><strong>Software Vendors<\/strong>: code confidence for clients<\/li>\n\n\n\n<li><strong>DevSecOps Teams<\/strong>: as part of secure SDLC workflows<\/li>\n<\/ul>\n\n\n\n<p>Here&#8217;s a breakdown of the <strong>core components of Fortify<\/strong> \u2014 both for <strong>on-premise<\/strong> and <strong>cloud deployments<\/strong> \u2014 explained in a <strong>clear and structured way<\/strong>, along with what each component does and how they fit into your development and DevSecOps pipeline.<\/p>\n\n\n\n<p>For students learning about application security or those working on assignments related to Fortify, discussing these concepts with peers can deepen understanding. Join the<a href=\"https:\/\/customwriting.com\/forum\/\" target=\"_blank\" rel=\"noreferrer noopener\"> essay forum<\/a> to share your thoughts, ask questions, and get valuable insights on tools, writing practices, and more.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83e\udde9 Core Components of Fortify<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Component<\/th><th>Description<\/th><th>Purpose<\/th><\/tr><\/thead><tbody><tr><td>\ud83e\udde0 <strong>Fortify Static Code Analyzer (SCA)<\/strong><\/td><td>The main engine that scans source code<\/td><td>Performs <strong>Static Application Security Testing (SAST)<\/strong><\/td><\/tr><tr><td>\ud83d\udcc2 <strong>Fortify Intermediate Language (FIL)<\/strong><\/td><td>An internal representation of your source code<\/td><td>Translates code into an abstract structure for deeper analysis<\/td><\/tr><tr><td>\ud83d\udcc1 <strong>.fpr File (Fortify Project Results)<\/strong><\/td><td>Scan result output<\/td><td>Contains all identified vulnerabilities in a project<\/td><\/tr><tr><td>\ud83e\uddd1\u200d\ud83d\udcbc <strong>Fortify Audit Workbench (AWB)<\/strong><\/td><td>Desktop GUI tool to review <code>.fpr<\/code> files<\/td><td>Lets security teams and developers analyze, filter, and prioritize vulnerabilities<\/td><\/tr><tr><td>\ud83d\udcca <strong>Fortify Software Security Center (SSC)<\/strong><\/td><td>Web-based dashboard and centralized server<\/td><td>Acts as the <strong>collaborative hub<\/strong> for managing scan results, assigning issues, and tracking remediation across teams<\/td><\/tr><tr><td>\ud83d\udd04 <strong>Fortify Rulepacks<\/strong><\/td><td>Set of security rules and definitions used by the scanner<\/td><td>Contains definitions for <strong>vulnerabilities<\/strong>, <strong>CWE mappings<\/strong>, and <strong>language-specific<\/strong> security patterns<\/td><\/tr><tr><td>\ud83d\udd0c <strong>Fortify IDE Plugins<\/strong><\/td><td>Extensions for IDEs like Visual Studio, Eclipse, IntelliJ<\/td><td>Allow <strong>developers to see vulnerabilities directly in their code<\/strong> while coding<\/td><\/tr><tr><td>\u2699\ufe0f <strong>Fortify CI\/CD Integrations<\/strong><\/td><td>Jenkins, Azure DevOps, GitLab, Bamboo plugins<\/td><td>Automate security scans as part of the <strong>DevOps pipeline<\/strong><\/td><\/tr><tr><td>\u2601\ufe0f <strong>Fortify on Demand (FoD)<\/strong><\/td><td>Cloud-hosted version of Fortify<\/td><td>Lets you upload code for scanning via the cloud \u2013 no infrastructure setup needed<\/td><\/tr><tr><td>\ud83d\udd10 <strong>Fortify WebInspect<\/strong> <em>(optional)<\/em><\/td><td>Dynamic Application Security Testing (DAST)<\/td><td>Scans <strong>live web applications<\/strong> for runtime vulnerabilities (not just static code)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd04 Typical Fortify Workflow (Component Interaction)<\/h1>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"CSS\" data-shcb-language-slug=\"css\"><span><code class=\"hljs language-css\"><span class=\"hljs-selector-attr\">&#91;Source Code]<\/span>\n     \u2193\n<span class=\"hljs-selector-attr\">&#91;Fortify SCA]<\/span>\n     \u2193\n<span class=\"hljs-selector-attr\">&#91;.fpr file]<\/span>\n     \u2193\n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510     \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n \u2502  <span class=\"hljs-selector-tag\">Audit<\/span>     \u2502     \u2502 <span class=\"hljs-selector-tag\">Software<\/span> <span class=\"hljs-selector-tag\">Security<\/span>   \u2502\n \u2502 <span class=\"hljs-selector-tag\">Workbench<\/span>  \u2502&lt;\u2500\u2500\u2500&gt;\u2502 <span class=\"hljs-selector-tag\">Center<\/span> (<span class=\"hljs-selector-tag\">SSC<\/span> <span class=\"hljs-selector-tag\">Web<\/span> <span class=\"hljs-selector-tag\">UI<\/span>) \u2502\n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n        \u2191                      \u2191\n  <span class=\"hljs-selector-attr\">&#91;Developer]<\/span>           <span class=\"hljs-selector-attr\">&#91;Security Team]<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">CSS<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">css<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83e\uddf0 Breakdown of Each Key Component<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">1. <strong>Fortify SCA (Static Code Analyzer)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>CLI-based tool.<\/li>\n\n\n\n<li>Scans source code using a build ID (<code>-b &lt;buildID><\/code>).<\/li>\n\n\n\n<li>Supports 25+ languages.<\/li>\n\n\n\n<li>Generates <code>.fpr<\/code> file with results.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2. <strong>Fortify Audit Workbench<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A GUI tool for local vulnerability triage.<\/li>\n\n\n\n<li>Helps filter false positives and classify issues.<\/li>\n\n\n\n<li>Allows exporting reports in different formats.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3. <strong>Fortify SSC (Software Security Center)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Web portal used by devs, QA, and AppSec teams.<\/li>\n\n\n\n<li>Tracks vulnerability trends across builds.<\/li>\n\n\n\n<li>Allows integration with issue trackers (e.g., JIRA).<\/li>\n\n\n\n<li>Enforces security policies and compliance reporting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4. <strong>Fortify Rulepacks<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Updated frequently.<\/li>\n\n\n\n<li>Includes rules for OWASP Top 10, SANS Top 25, PCI-DSS, HIPAA, etc.<\/li>\n\n\n\n<li>Custom rulepacks can be created for specific coding patterns or frameworks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5. <strong>IDE Plugins<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Available for:\n<ul class=\"wp-block-list\">\n<li><strong>IntelliJ \/ Eclipse (Java)<\/strong><\/li>\n\n\n\n<li><strong>Visual Studio (C#, VB.NET)<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Lets devs scan code within their IDE.<\/li>\n\n\n\n<li>Improves adoption of secure coding practices.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6. <strong>CI\/CD Integrations<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Fortify provides native or scripted plugins for:\n<ul class=\"wp-block-list\">\n<li><strong>Jenkins<\/strong><\/li>\n\n\n\n<li><strong>Azure DevOps<\/strong><\/li>\n\n\n\n<li><strong>GitLab<\/strong><\/li>\n\n\n\n<li><strong>TeamCity<\/strong><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Scans can be triggered as part of build pipelines.<\/li>\n\n\n\n<li>Break the build on critical issues.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7. <strong>Fortify on Demand (FoD)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS version of Fortify.<\/li>\n\n\n\n<li>No infrastructure setup.<\/li>\n\n\n\n<li>Ideal for smaller teams or teams without internal security infrastructure.<\/li>\n\n\n\n<li>API-based upload and scan.<\/li>\n\n\n\n<li>Offers both <strong>SAST<\/strong> and <strong>DAST<\/strong> in the cloud.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udd04 Fortify Component Integration in CI\/CD Pipeline<\/h1>\n\n\n<pre class=\"wp-block-code\"><span><code class=\"hljs\">Developer \u2192 Push Code \u2192 CI\/CD Pipeline \u2192 Run Fortify SCA\n                                             \u2193\n                               Generate .fpr &amp; Upload to SSC\n                                             \u2193\n                          SSC Dashboard \u2192 Review \u2192 Triage Issues\n                                             \u2193\n                               Developer Fix \u2192 Re-scan \u2192 Repeat\n<\/code><\/span><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udee1\ufe0f Bonus: Add-on Component (DAST)<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">\ud83d\udd0d Fortify WebInspect (Dynamic Testing)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scans running applications (vs. code).<\/li>\n\n\n\n<li>Detects runtime flaws: XSS, CSRF, insecure cookies, etc.<\/li>\n\n\n\n<li>Can be used in combo with SCA for complete AppSec testing.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83d\udcd8 Summary: Fortify Components at a Glance<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Component<\/th><th>Role<\/th><\/tr><\/thead><tbody><tr><td>Fortify SCA<\/td><td>Scans code statically<\/td><\/tr><tr><td>Fortify AWB<\/td><td>Analyze results locally<\/td><\/tr><tr><td>Fortify SSC<\/td><td>Centralized vulnerability management<\/td><\/tr><tr><td>Rulepacks<\/td><td>Security intelligence rules<\/td><\/tr><tr><td>IDE Plugins<\/td><td>Secure coding at development time<\/td><\/tr><tr><td>CI\/CD Plugins<\/td><td>Automated scanning during build<\/td><\/tr><tr><td>Fortify on Demand<\/td><td>Cloud-based AppSec solution<\/td><\/tr><tr><td>WebInspect<\/td><td>Runtime DAST scanning<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p>Let me know if you&#8217;d like:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A visual diagram of Fortify components<\/li>\n\n\n\n<li>Hands-on lab setup using Fortify CLI + Jenkins + SSC<\/li>\n\n\n\n<li>Comparison with other tools like Snyk, SonarQube, or Checkmarx<\/li>\n<\/ul>\n\n\n\n<p>I&#8217;m happy to extend this into a training module or tutorial set too!<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">\ud83c\udfc1 Summary: Why Fortify?<\/h1>\n\n\n\n<p>\u2714\ufe0f Scans code before execution<br>\u2714\ufe0f Supports 25+ languages<br>\u2714\ufe0f Integrates with CI\/CD<br>\u2714\ufe0f Helps meet compliance &amp; reduce risk<br>\u2714\ufe0f Improves secure coding knowledge in devs<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ud83d\udee1\ufe0f What is Fortify? Fortify is a Static Application Security Testing (SAST) tool developed by Micro Focus (now part of OpenText). It helps developers and security teams identify vulnerabilities early&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-29283","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/29283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=29283"}],"version-history":[{"count":3,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/29283\/revisions"}],"predecessor-version":[{"id":49379,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/29283\/revisions\/49379"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=29283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=29283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=29283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}