Fortify Static Code Analysis in Pipelines

How the Fortify task works

Fortify works by analyzing the JAVA libraries for any known vulnerabilities. Required installed extension - Micro Focus Fortify. It is a white-box testing tool, it identifies the root cause of vulnerabilities and helps remediate the underlying security flaws. SAST solutions analyze an application from the “inside out” and do not reed a running system to perform a scan.

Fortify Agent

For the possibility to run Fortify task our project was provided with a special Agent from Security Team. The agent should be pointed in the “pool” section of pipelines and added to the project where you plan to use this task.

Pool configuration

pool:

name: Fortify

Task Usage Example

Official task documentation page: FortifySCA@7

Task 'SAST Fortify Report Generation' is used for converting scanning results to HTML format.

Quality Gates

The standard quality gates for Fortify Java language are used.

Limitation

The current Fortify SCA implementation has a limitation that reports are not sent back to Azure DevOps. For this purpose verification of Fortify report needs to occur manually on schedule.

The suggested schedule is:

• Verify and fix vulnerabilities reported before promoting code from Dev to QA environment
• Verify and fix vulnerabilities reported before promoting code from UAT to Production environment

As the reports need to be fetched manually on the Fortify server, it is recommended to coordinate with Info Sec team on a scheduled dates through the DevOps team.