IBM Security AppScan V8.8 portfolio supports collaborative and analytical security testing throughout the software development lifecycle

Transcription

1 IBM Latin America Software Announcement LP , dated October 8, 2013 IBM Security AppScan V8.8 portfolio supports collaborative and analytical security testing throughout the software development lifecycle Table of contents 1 Overview 5 Publications 2 Key prerequisites 5 Technical information 3 Planned availability date 11 Ordering information 3 Description 24 Terms and conditions 4 Program number 28 Prices At a glance IBM Security AppScan V8.8 delivers: Improved time to value on static analysiswith: Streamlined triage features to quickly identify security risk Faster and easier configuration of Java TM applications Quickly identified confirmed vulnerabilities: Top security risks identified by leveraging latest industry standards from Open Web Application Security Project (OWASP) top and OWASP Mobile Security Project - top 10 Mofile Risks Filters and scan confirmations that help ensure security compliance and best practices Enhanced encryption to protect your security assets: Supports industry-standard Transport Layer Security (TLS) protocol 1.2 compliance with National Institute of Standards and Technology (NIST) Special Publication (SP) a Overview IBM Security AppScan V8.8 application security portfolio continues to deliver on static, dynamic, and interactive application security testing. IBM Security AppScan portfolio provides a platform for centrally managing application security testing and risk management as critical elements of application lifecycle management. What is new IBM Security AppScan Source: Enhanced encryption (support for Transport Layer Security (TLS) 1.2), and compliance with National Institute of Standards and Technology (NIST) Special Publication (SP) a. Improved analysis accuracy through expanded framework support. Comprehensive framework support does not require configuration. New supported frameworks include Spring MVC 3, ASP.NET MVC, Microsoft TM.NET 4.5, Java JAX-RS (V1.0 and V1.1), Java JAX-WS (V2.2), and Web Service Definition Language (WSDL). Generates scans faster and more easily with simplified configuration and improved support for common Java web application dependencies. IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 1

2 Streamlined triage features to quickly identify and isolate the most important security risks. Triage usability improvements include improved vulnerability matrix, more descriptive names, and display optimizations to help maximize graphical trace information. Includes new scan configurations to help speed analysis and to produce more actionable results. The standard scan configurations help make it easy to focus on specific types of vulnerabilities which enables organizations to prioritize their application security policies. New scan configurations include ios to focus on mobile security and user input to isolate security risk introduced by users. Has new and enhanced analysis filters including Open Web Application Security Project (OWASP) Top and OWASP Top 10 Mobile Risks to help ensure security compliance and best practices. Filters help to produce smaller, more actionable results designed to ensure development teams focus on confirmed vulnerabilities. Delivers additional authentication support to help simplify user management and make large deployments easier. New in this release is support for Microsoft Windows TM authentication. Improved Integrated Development Environment (IDE) support designed to make working with the most current and popular development tools easier; updates include Visual Studio 2012, Eclipse 4.2, 4.2.2, 4.3, and IBM Rational Application Developer V9.0. IBM Security AppScan Standard: Enhanced encryption support for TLS 1.2 and compliance with National Institute of Standards and Technology (NIST) Special Publication (SP) a. Allows recording an action-based login sequence, which enables scan session management for certain types of applications. Improved login mechanism and session handling: Allows recording of an action-based login sequence to increase login success in certain applications. Enhanced methods to detect session tokens, that improve session handling. Updated OWASP Top report for identifying noncompliance issues. : Enhanced encryption support for TLS 1.2, and compliance with NIST SP a. Leverages the scalability of the Enterprise Dynamic Analysis Scanner by importing and scheduling scans configured with the AppScan Standard desktop application. Reuses functional quality assurance test scripts and implements Dynamic Analysis security testing automation via new Representational State Transfer (REST) API interfaces. Delivers more flexibility for configuring decentralized AppScan Enterprise administration via finer custom user type settings for adding, deleting and editing users and groups. Includes updated OWASP Top 10 (2013) report for identifying noncompliance issues. Key prerequisites For details, refer to the Hardware requirements and the Software requirements sections. IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 2

3 Planned availability date October 22, 2013: For electronic availability November 12, 2013: For media availability Refer to the Availability of national languages section for national language availability. Description Software runs business. From the application that manages temperature in a nuclear power plant to the website that drives and collects all incoming business and reservations, there is one commonality to business success -- the ability for those applications for function correctly. The most efficient way to stay ahead of application security vulnerabilities is to build software securely, from the ground up. The challenge is that many organizations do not know how to design and implement secure applications. The majority of developers are not security experts, and secure coding is historically not identified as a priority. As a result, web-based and nonweb-based applications alike continue to be deployed with vulnerabilities that put sensitive data at risk of a breach. There is a better way. Because the onerous task of vulnerability identification and remediation cannot be successfully addressed by limited IT security resources, one success path is to engage development in the process of application security by providing tools that fit into the existing environment and workflow. These tools should generate results in a way that is easily understood by all stakeholders: development, security and audit personnel, business owners, and executives. The IBM Security AppScan portfolio provides offerings that support and enhance application security testing across the full application lifecycle. IBM Security AppScan V8.8 is a leading application security test suite designed to help manageability testing throughout the software development lifecycle. AppScan offers a time-saving solution for all types of security testing: outsourced, individual, and enterprise-wide analysis, and for all types of users including application developers, build managers, quality assurance (QA) teams, penetration testers, security auditors, and senior management. The IBM Security AppScan portfolio includes offerings used to test all aspects of the application portfolio at any size organization, whether it is live applications running in production or source code. AppScan validates findings and prioritizes reported results so remediation time is reduced. Reports include issuing advisories and advanced fix recommendations designed to educate and help developers and security auditors remediate the identified vulnerabilities. IBM Security AppScan offerings IBM Security AppScan Standard is a desktop solution that utilizes Interactive Application Security Testing (IAST) and Dynamic Application Security testing (DAST). The patent-pending glass box feature in IBM Security AppScan Standard provides IAST through run-time analysis - an automated method of combining static and dynamic techniques in real time to improve the accuracy of test results. Interactive testing is next-generation testing that combines aspects of static and dynamic testing, and interactively analyzes results in real time. Benefits of glass box, or interactive testing, include more accurate test results, identification of new threat categories, and the ability to pinpoint specific lines of code and details that facilitate remediation. is an enterprise-class solution for application security testing and risk management. provides robust capabilities for governance and facilitates collaboration between development, quality assurance, and security teams across the organization. IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 3

4 It centrally manages dynamic, static, and interactive security assessments. It provides enterprise metrics and trending for monitoring application security program progress. It also integrates with IBM Security QRadar to incorporate application vulnerability data into overall security intelligence. IBM Security AppScan Source analyzes source code during the development and build stages of the application lifecycle to identify security vulnerabilities with Static Application Security Testing (SAST) and integrates security testing with the software development processes and systems. IBM Security AppScan Source supports secure mobile application development with testing for native Apple ios (Objective-C) and Android ( Java ) applications. Accessibility by people with disabilities A US Section 508 Voluntary Product Accessibility Template (VPAT) containing details on accessibility compliance can be requested at Availability of national languages Language Electronic availability date English October 22, 2013 Portuguese (Brazil) October 22, 2013 Program number Program Program number VRM name 5724-T IBM Security AppScan Standard 5724-T Z IBM Security AppScan Source for Automation 5724-Z IBM Security AppScan Source for Analysis 5724-Z Z IBM Security AppScan Source for Remediation Education support IBM training provides education to support many IBM offerings. Descriptions of courses for IT professionals and managers are on the IBM training website Contact your IBM representative for course information. Offering Information Product information is available via the Offering Information website Also, visit the Passport Advantage website IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 4

5 Publications V8.8 Planning and Installation Guide is shipped with V8.8. The following publications are shipped with IBM Security AppScan Standard V8.8: IBM Security AppScan Standard V8.8 Getting Started Guide IBM Security AppScan Standard V8.8 Getting Started Guide IBM Security AppScan Standard V8.8 Glass Box User Guide The following publications can be found, at electronic availability, at the below IBM Publication Center: IBM Security AppScan Standard 8.8 Getting Started Guide (GI ) IBM Security AppScan Standard 8.8 User Guide (SC ) IBM Security AppScan Standard 8.8 Glass Box User Guide (SC ) These documents, and other online relevant documentation are listed in the Security AppScan Standard Publications library at The following publications are shipped with IBM Security AppScan Source V8.8: IBM Security AppScan Source for Analysis User Guide IBM Security AppScan Source Installation and Administration Guide IBM Security AppScan Source Utilities User Guide These documents and other online relevant documentation are available, at electronic availability, at The IBM Publications Center is available at The Publications Center is a worldwide central repository for IBM product publications and marketing material with a catalog of 70,000 items. Extensive search facilities are provided. Payment options for orders are via credit card (in the US) or customer number for 20 countries. A large number of publications are available online in various file formats, and they can all be downloaded by all countries, free of charge. Technical information Specified operating environment Hardware requirements IBM Security AppScan Source V8.8 Disk space: Approximately 2 GB of available hard disk space (3 GB required for installation) Media drive: CD-ROM or DVD-ROM drive Memory: 2 GB of RAM (minimum); 8G of RAM or more recommended Processor: 2 CPU IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 5

6 For current information about IBM Security AppScan Source V8.8 hardware requirements, at electronic availability, refer to V8.8 This configuration supports an average size deployment of three to four Dynamic Analysis Scanners (two concurrent scan jobs per scanner). Larger deployments or loads may require more resources. Disk space: Approximately 200 GB for the AppScan Enterprise Server and Jazz TM Team Server Approximately 500 GB of free space for scan logs on the Dynamic Analysis Scanner Approximately 1 TB of free space on the system hosting the SQL Server database Approximately 330 MB for the Web Services Explorer - Generic Service Client tool (GSC) version 8.1 used to test Web Services for security vulnerabilities Memory: 16 GB of RAM (minimum) or more recommended for SQLServer database and Dynamic Analysis Scanner 8 GB of RAM or more recommended AppScan Enterprise Server and Jazz Team Server Processor: 4 CPU recommended for SQL Server database and Dynamic Analysis Scanner 2 CPU recommended for AppScan Enterprise Server and Jazz Team Server For current information about 8.8 hardware requirements, at electronic availability, refer to IBM Security AppScan Standard V8.8 Disk space: Approximately 30 GB of available hard disk space Memory: 3 GB of RAM or more recommended NIC network driver: 1 NIC 100 Mbps for network communication with configured TCP/IP Processor: Core 2 Duo 2 GHz (or equivalent) For current information about IBM Security AppScan Standard V8.8 hardware requirements, at electronic availability, refer to Software requirements IBM Security AppScan Source V8.8 IBM Security AppScan Source V8.8 has dropped support for Microsoft Windows XP and Microsoft Windows Server Operating systems Macintosh operating systems Mac OS X 10.7 (64 bit, on which Security AppScan Source runs in 32-bit mode) OS X 10.8 IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 6

7 Linux TM (On 64-bit Linux, Security AppScan Source runs in 32-bit mode.) Red Hat Enterprise Linux (RHEL) 5, 6, 6.1, 6.2, 6.3, and 6.4 Microsoft Windows (On 64-bit Windows, Security AppScan Source runs in 32-bit mode.) Microsoft Windows 7 Enterprise, Professional, and Ultimate Microsoft Windows Server 2008 Enterprise and Standard 32-bit x86 Microsoft Windows Server 2008 R2 Enterprise and Standard Microsoft Windows Server 2012 DataCenter, Standard, Essentials, and Foundation Prerequisite system requirements License use management IBM Rational License Key Server V8.1.1, V8.1.2, V8.1.3, V8.1.4, and future fix packs Other system requirements Compilers Microsoft Visual Studio 2008, 2010, and 2012 gcc for Linux Jasper Version 2 (Tomcat Versions 5, 6, and 7) WebLogic Versions 8, 9, 11, and 12 IBM WebSphere Application Server V6.1, V7.0, V8.0, and V8.5 XCode for Objective-C (for Apple ios applications only) External databases Oracle Database 11g For integration scenarios with various AppScan Source products, refer to AppScan Source product help. IBM Rational Application Developer for WebSphere Software V8.0, V8.0.1, V8.0.2, V8.0.3, V8.0.4, V8.5, V8.5.1, V9.0, and future fix packs Eclipse 3.6, 3.7, 3.8, 4.2, 4.2.2, 4.3, and future modification levels and fix packs Security AppScan Enterprise V8.8 and future modification levels and fix packs Microsoft.NET Framework 2.0, 3.0, 3.5, 4.0, and 4.5 Microsoft Visual Studio 2008, 2010, 2012 Defect tracking systems Microsoft Team Foundation Server 2008, 2010, and future fix packs IBM Rational Team Concert TM V3.0, V3.0.1, V4.0, V4.0.1, V4.0.2, V4.0.3, V4.0.4, and future fix packs IBM Rational ClearQuest V7.1.2, V7.1.1, V8.0, V8.0.1, and future fix packs HP Quality Center 9.2, 10.0, 11.0, and future fix packs Reports Adobe TM Reader Version 6.0, or later ( Microsoft Windows ) Adobe Reader Version 5.0 ( Linux ) IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 7

8 For current information about IBM Security AppScan Source V8.8 software requirements, at electronic availability, refer to V8.8 V8.8 has dropped support for Windows XP and Windows Server Operating systems Linux (On Linux, Security AppScan Enterprise is used only with Security AppScan Source.) Red Hat Enterprise Linux (RHEL) 6, 6.2, 6.3, and 6.4 Windows Microsoft Windows Server 2008 and 2008 R2 Standard and Enterprise Microsoft Windows Server 2012 Datacenter and Standard The following Windows operating systems are only for the client side of Enterprise Server and Dynamic Analysis Scanner. Microsoft Windows 7 Enterprise, Professional, and Ultimate Prerequisite system requirements.net Microsoft.NET Framework 4.5 is required. Browsers Microsoft Internet Explorer 8.0, 9.0, 10, and future modification levels and fix packs (used for both Manual Explore and Dynamic Assessment Plugins) li. Mozilla Firefox 17.0 ESR, and future fix packs (used for both Manual Explore and Dynamic Assessment Plugins) Google Chrome (only for Manual Explore Desktop Tool) Databases Microsoft SQL Server 2008 Standard and Enterprise SP3, 2012, and future fix packs Microsoft SQL Server 2008 R2 SP2, and future fix packs License use management IBM Rational License Key Server V8.1.1, V8.1.2, V8.1.3, V8.1.4, and future fix packs (required for floating user licenses) Web servers IBM WebSphere Application Server V , and future fix packs Apache Tomcat , and future fix packs Other system requirements Integration IBM Security SiteProtector TM System V2.9, V3.0, and future fix packs IBM WebSphere Portal Server V , and future fix packs IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 8

9 IBM Rational AppScan Source V7.0 - V8.8 inclusive (previous versions are supported for importing of security results only) IBM Rational AppScan Standard V7.7 - V8.8 inclusive (previous versions are supported for importing of security results only) IBM Security AppScan Source V8.8 integrates with IBM Security AppScan Enterprise V8.8 Server IBM Rational Team Concert V3.0, V3.0.1, V4.0, V4.0.1, and future fix packs IBM Rational Quality Manager V and V4.0.2 IBM Security QRadar SIEM V7.0 M5 IBM Security QRadar V7.1 and V71 M1 and M2 IBM Security QRadar SIEM V7.2 For current information about V8.8 software requirements, at electronic availability, refer to IBM Security AppScan Standard V8.8 IBM Security AppScan Standard V8.8 has dropped support for Windows XP and Windows Server Operating systems (both 32-bit and 64-bit editions) Microsoft Windows Windows Server 2008 Standard and Enterprise, SP1 and SP2 Windows Server 2008 R2 Standard and Enterprise, with or without SP1 Windows Server 2012 DataCenter, Standard, Essentials and Foundation Windows 7 Enterprise, Professional, and Ultimate, with or without SP1 Windows 8 Enterprise, Professional, 32-bit X86 and X64 Note: Security AppScan smart tags, used when creating custom reports, are not supported for Windows Server Browser Microsoft Internet Explorer Versions 7, 8, and 9, and Version 10 on Windows 7, Windows 8 and Windows License key server Rational License Key Server V8.1.1, V8.1.2, V8.1.3, and V8.1.4 Defect tracking systems Rational ClearQuest V7.1.1, V7.1.2, V8.0, and V8.0.1 HP Quality Center 9.2 and 10.0 Other Microsoft.NET Framework Version 4.5 is required. Optional: Adobe Flash Player for Internet Explorer, Version , or later Optional: Microsoft Word 2003, 2007, 2010, or 2013 for custom report templates. Word 2003 or 2007 for Security AppScan smart tags to insert fields for custom report templates. AppScan Standard glass box server requirements Java platform Enterprise Edition containers: JBoss Application Server 6 and 7 IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 9

10 JBoss Enterprise Application Platform 7.1 Tomcat 6 and 7 WebLogic 10 and 11.1 IBM WebSphere Application Server V7.0, V8.0, and V8.5 Glass box operating systems Microsoft Windows : Windows Server 2008 R2 with and without SP1 Windows Server 2008 Enterprise, SP1 and SP2 Windows Server 2012 UNIX TM : Linux RHEL 5 and 6 Linux SLES 10 SP4 and 11 SP2 UNIX AIX 6.1 and 7 UNIX Solaris 10 (SPARC) and 11 For current information about IBM Security AppScan Standard V8.8 software requirements, at electronic availability, refer to The program's specifications and specified operating environment information may be found in documentation accompanying the program, if available, such as a readme file, or other information published by IBM, such as an announcement letter. Documentation and other program content may be supplied only in the English language. IBM Electronic Support The IBM Support Portal is your gateway to technical support. This includes IBM Electronic Support tools and resources, for software and hardware, to help save time and simplify support. The Electronic Support tools can help you find answers to questions, download fixes, troubleshoot, automate data collection, submit and track problems through the Service Request online tool, and build skills. All these tools are made available through your IBM support agreement, at no additional charge. Read about the Electronic Support portfolio of tools Access the IBM Support Portal Access the online Service Request tool Planning information Packaging IBM Security AppScan is distributed with: International Program License Agreement (Z ) License Information document DVDs IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 10

11 Publications (refer to the Publications section) This program, when downloaded from a website, contains the applicable IBM license agreement and License Information, if appropriate, and will be presented for acceptance at the time of installation of the program. For future reference, the license and License Information will be stored in a directory such as LICENSE.TXT. Security, auditability, and control IBM Security AppScan V8.8 uses the security and auditability features of the operating system software. The customer is responsible for evaluation, selection, and implementation of security features, administrative procedures, and appropriate controls in application systems and communication facilities. Ordering information This product is only available via Passport Advantage. It is not available as shrinkwrap. These products may only be sold directly by IBM or by authorized IBM Business Partners for Software Value Plus. For more information about IBM Software Value Plus, visit To locate IBM Business Partners for Software Value Plus in your geography for a specific Software Value Plus portfolio, visit Product group: IBM Security AppScan Product Identifier Description (PID) V T52 IBM Security AppScan Source for Automation V Z34 IBM Security AppScan Source for Analysis V Z35 V Z36 IBM Security AppScan Source for Remediation V Z37 IBM Security AppScan Standard V T59 Product category: Security AppScan Passport Advantage Description Part number (5724-T52) Reporting Only Reporting Only User Authorized User Single Install License + Reporting Only User Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months D056CLL E05ELLL Reporting Only User Authorized User Single Install Reporting Only User License + D056DLL D07YELL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 11

12 Reporting Only User Annual SW Subscription & Support Renewal 12 Months Reporting Only User Reporting Only User for System z Authorized User Single Install License + Reporting Only User for System z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months Reporting Only User for System z Authorized User Single Install Reporting Only User for System z License + Reporting Only User for System z Annual SW Subscription & Support Renewal 12 Months Reporting Only User for System z E06GHLL D07YFLL D0569LL E05EJLL D056ALL D07YCLL E06GGLL D07YDLL Fixed term licenses Reporting Only User Authorized User Single Install Initial Fixed Term License + Reporting Only User Authorized User Single Install Subsequent Fixed Term License + Reporting Only User Initial Fixed Term License + Reporting Only User Subsequent Fixed Term License + Reporting Only User for System z Initial Fixed Term License + Reporting Only User For System z Subsequent Fixed Term License + Reporting Only User for System Z D056BLL E05EKLL D0L7GLL E0CRTLL D0L7HLL E0CRULL D0L7FLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 12

13 Authorized User Single Install Initial Fixed Term License + Reporting Only User for System z Authorized User Single Install Subsequent Fixed Term License + Description E0CRSLL Part number (5724-T52) Dynamic Analysis Scanner Dynamic Analysis Scanner Install License + Dynamic Analysis Scanner Install Annual SW Subscription & Support Renewal 12 Months Dynamic Analysis Scanner Install Dynamic Analysis Scanner for System Z Install License + Dynamic Analysis Scanner for System Z Install Annual SW Subscription & Support Renewal 12 Months Dynamic Analysis Scanner for System Z Install SW Subscription & Support Reinstatement 12 Months D0L73LL E0CRJLL D0L74LL D0L75LL E0CRKLL D0L76LL Fixed term licenses Dynamic Analysis Scanner Install Initial Fixed Term License + Dynamic Analysis Scanner Install Subsequent Fixed Term License + Dynamic Analysis Scanner for System Z Install Initial Fixed Term License + SW Subscription & Support 12 Month Dynamic Analysis Scanner for System Z Install Subsequent Fixed Term License + Description D0L7DLL E0CRQLL D0L7ELL E0CRRLL Part number (5724-T52) Authorized User Single Install License + Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months Authorized User Single Install License + D61V2LL E047CLL D61V4LL D07YALL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 13

14 Annual SW Subscription & Support Renewal 12 Months for System Z Authorized User Single Install License + for System Z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months for System Z Authorized User Single Install for System z License + for System z Annual SW Subscription & Support Renewal 12 Months for System z E06GFLL D07YBLL D61V3LL E047DLL D61V5LL D07Y8LL E06GELL D07Y9LL Fixed term licenses Initial Fixed Term License + Subsequent Fixed Term License + for System Z Initial Fixed Term License + for System Z Subsequent Fixed Term License + Authorized User Single Install Initial Fixed Term License + Authorized User Single Install Subsequent Fixed Term License + for System Z Authorized User Single Install Initial Fixed Term License + for System Z Authorized User Single Install Subsequent Fixed Term License + Description D0L7KLL E0CRXLL D0L7LLL E0CRYLL D040HLL E04SILL D0L7JLL E0CRWLL Part number IBM Security App Scan Enterprise (5724-T52) Server Basic IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 14

15 Server Basic Install License + Server Basic Install Annual SW Subscription & Support Renewal 12 Months Server Basic Install Server Basic for System Z Install License + Server Basic for System Z Install Annual SW Subscription & Support Renewal 12 Months Server Basic for System Z Install D0L6CLL E0CRBLL D0L6DLL D0L6ELL E0CRCLL D0L6FLL Fixed Term Licenses Server Basic Install Initial Fixed Term License + Server Basic Install Subsequent Fixed Term License + Server Basic for System Z Install Initial Fixed Term License + Server Basic for System Z Install Subsequent Fixed Term License + Description D0L79LL E0CRLLL D0L7ALL E0CRMLL Part number IBM Security App Scan Enterprise (5724-T52) Server Server Install License + Server Install Annual SW Subscription & Support Renewal 12 Months Server Install Server for System Z Install License + Server for System Z Install Annual SW Subscription & Support Renewal 12 Months Server for System Z Install D0L6GLL E0CRDLL D0L6HLL D0L6JLL E0CRELL D0L6KLL Fixed term licenses Server Install Initial Fixed Term License + Server Install Subsequent Fixed Term License + Server for System Z D0L7BLL E0CRNLL D0L7CLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 15

16 Install Initial Fixed Term License + Server for System Z Install Subsequent Fixed Term License + Description E0CRPLL Part number IBM Security AppScan Source for Automation (5724-Z34) IBM Security AppScan Source for Automation Install License + IBM Security AppScan Source for Automation Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Automation Install IBM Security AppScan Source for Automation for System z Install License + IBM Security AppScan Source for Automation for System z Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Automation for System z Install D0BQVLL E086LLL D0BQWLL D0CHBLL E08K9LL D0CHCLL Fix term licenses IBM Security AppScan Source for Automation for System z Install Initial Fixed Term License + IBM Security AppScan Source for Automation for System z Install Subsequent Fixed Term License + IBM Security AppScan Source for Automation Install Initial Fixed Term license + IBM Security AppScan Source for Automation Install Subsequent Fixed Term License + Description D0CHELL E08KBLL D0BR8LL E086ULL Part number (5624-Z36) Authorized User Single Install License + Authorized User Single Install Annual SW Subscription & Support Renewal Authorized User Single Install for System z Authorized User Single Install License + for System z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months for System z Authorized User Single Install D0BQZLL E086NLL D0BR0LL D0CHTLL E08KKLL D0CHULL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 16

17 License + Annual SW Subscription & Support Renewal 12 Months for System z License + for System z Annual SW Subscription & Support Renewal 12 Months for System z D0BQXLL E086MLL D0BQYLL D0CHXLL E08KMLL D0CHYLL Fixed term licenses Authorized User Single Install Initial Fixed Term License + Authorized User Single Install Subsequent Fixed Term License + Initial Fixed Term License + Subsequent Fixed Term License + for System z Authorized User Single Install Initial Fixed Term License + for System z Authorized User Single Install Subsequent Fixed Term License + for System z Initial Fixed Term License + for System z Subsequent Fixed Term License + Description D0BRALL E086WLL D0BR9LL E086VLL D0CIELL E08KWLL D0CIFLL E08KXLL Part number IBM Security AppScan Source for Remediation (5724-Z37) IBM Security AppScan Source for Remediation Authorized User Single Install License + IBM Security AppScan Source for Remediation Authorized User Single Install Annual SW Subscription & Support Renewal12 Months D0BR3LL E086QLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 17

18 IBM Security AppScan Source for Remediation Authorized User Single Install IBM Security AppScan Source for Remediation for System z Authorized User Single Install License + IBM Security AppScan Source for Remediation for System z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Remediation for System z Authorized User Single Install IBM Security AppScan Source for Remediation License + IBM Security AppScan Source for Remediation Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Remediation IBM Security AppScan Source for Remediation for System z License + IBM Security AppScan Source for Remediation for System z Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Remediation for System z D0BR4LL D0CI1LL E08KNLL D0CI2LL D0CI7LL E08KTLL D0CI8LL D0CIBLL E08KVLL D0CICLL Fixed term licenses IBM Security AppScan Source for Remediation Authorized User Single Install Initial Fixed Term License + IBM Security AppScan Source for Remediation Authorized User Single Install Subsequent Fixed Term License + IBM Security AppScan Source for Remediation Initial Fixed Term License + IBM Security AppScan Source for Remediation Subsequent Fixed Term License + IBM Security AppScan Source for Remediation for System z Authorized User Single Install Initial Fixed Term License + SW Subscription & Support 12 Months IBM Security AppScan Source for Remediation for System z Authorized User Single Install Subsequent Fixed Term License + IBM Security AppScan Source for Remediation for System z Initial Fixed Term License + D0BRCLL E086YLL D0CIGLL E08KYLL D0CI4LL E08KQLL D0CIALL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 18

19 IBM Security AppScan Source for Remediation for System z Subsequent Fixed Term License + Description E08KULL Part number IBM Security AppScan Source for Analysis (5724-Z35) IBM Security AppScan Source for Analysis Authorized User Single Install License + SW Subscription & Support 12 Months IBM Security AppScan Source for Analysis Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Analysis Authorized User Single Install SW Subscription & Support Reinstatement 12 Months IBM Security AppScan Source for Analysis License + IBM Security AppScan Source for Analysis Annual SW Subscription & Support Renewal12 Months IBM Security AppScan Source for Analysis IBM Security AppScan Source for Analysis for System z Authorized User Single Install License + IBM Security AppScan Source for Analysis for System z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Analysis for System z Authorized User Single Install IBM Security AppScan Source for Analysis for System z License + IBM Security AppScan Source for Analysis for System z Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Source for Analysis for System z D0BQTLL E086KLL D0BQULL D0CHKLL E08KGLL D0CHLLL D0CHILL E08KFLL D0CHJLL D0CHPLL E08KILL D0CHQLL Fixed term licenses IBM Security AppScan Source for Analysis Authorized User Single Install Initial Fixed Term License + D0BR7LL IBM Security AppScan Source for Analysis E086TLL Authorized User Single Install Subsequent Fixed Term License + IBM Security AppScan Source for Analysis Initial Fixed Term License + D0CHHLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 19

20 IBM Security AppScan Source for Analysis Subsequent Fixed Term License + IBM Security AppScan Source for Analysis for System z Authorized User Single Install Initial Fixed Term License + IBM Security AppScan Source for Analysis for System z Authorized User Single Install Subsequent Fixed Term License + IBM Security AppScan Source for Analysis for System z Initial Fixed Term License + IBM Security AppScan Source for Analysis for System z Subsequent Fixed Term License + Description IBM Security AppScan Standard (5724-T59) IBM Security AppScan Standard Authorized User Single Install Annual SW S&S Rnwl 12 Mo IBM Security AppScan Standard Authorized User Single Install Lic + SW S&S 12 Mo IBM Security AppScan Standard Authorized User Single Install SW S&S Reinstate 12 Mo IBM Security AppScan Standard for System Z Authorized User Single Install License + IBM Security App Scan Standard for System Z Authorized User Single Install IBM Security App Scan Standard for System Z Authorized User Single Install Annual SW Subscription & Support Renewal 12 Months IBM Security AppScan Standard Floating User Single Inst Annual SW S&S Rnwl 12 Mo IBM Security AppScan Standard Floating User Single Inst Lic + SW S&S 12 Mo IBM Security AppScan Standard Floating User Single Inst SW S&S Reinstate 12 Mo IBM Security AppScan Standard for System z Annual SW S&S Renewal 12 Months IBM Security AppScan Standard for System z License + SW S&S 12 Months IBM Security AppScan Standard Linux for System z SW S&S Reinstatement 12 Months Fixed term licenses IBM Security AppScan Standard Floating User Single Install Initial Fixed Term License + IBM Security AppScan Standard Subsq FT Lic+S&S 12 Mo IBM Security AppScan Standard for System Z Initial Fixed Term License + IBM Security AppScan Standard for System Z Subsequent Fixed Term License + IBM Security AppScan Standard Authorized User Single Install Initial Fixed Term License + IBM Security AppScan Standard Authorized User Single Install Subsequent E08KELL D0CHFLL E08KCLL D0CHGLL E08KDLL Part number E0D71LL D0N1KLL D0N1LLL D0N1MLL D0N1NLL E0D72LL E046DLL D61SYLL D61SZLL E046ELL D61T0LL D61T1LL D040CLL E04SDLL D0NEKLL E0DBCLL D0N1PLL E0D73LL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 20

21 Fixed Term License + IBM Security AppScan Standard for System Z Authorized User Single Install Initial Fixed Term License + IBM Security AppScan Standard for System Z Authorized User Single Install Subsequent Fixed Term License + Passport Advantage trade up D0N1QLL E0D74LL You must have previously acquired licenses for the following precursor products to be eligible to acquire equivalent licenses of the trade-up products. Trade-up product FROM precursor product description Server Install FROM Server Basic Per Install Trade-up License + Authorized User Single Install FROM Reporting Only User Per Trade-up License + Trade-up part number D0L6ILL D0L6SLL D0L6RLL FROM IBM Security AppScan Dynamic Analysis User Per Authorized User Single Install Trade-up License + SW Subscription & Support 12 Months FROM Reporting Only User per Trade-up License + Reporting Only User FROM Reporting Only User Authorized User Single Install Trade-up License + Floating User FROM IBM Security AppScan Source for Remediation Floating User Trade-up License + SW Subscription & Support 12 Months Authorized User FROM IBM Security AppScan Source for Remediation per Authorized User Trade-up License + SW Subscription & Support 12 Months Floating User FROM Security AppScan Source Edition for Development Authorized User Trade-up License + SW Subscription & Support 12 Months IBM Security AppScan Source for Remediation Floating User FROM Security AppScan Source for Remediation Authorized User Trade-up License + SW Subscription & Support 12 Months IBM Security AppScan Source for Analysis FROM IBM Security AppScan Source for Analysis Authorized User Single Install Trade-up License + D0L6ZLL D0L77LL D0CIJLL D0CILLL D0CIKLL D0CI9LL D0CHMLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 21

22 Reporting Only User FROM Security AppScan Enterprise Reporting Only User for System z Authorized Single Install Trade Up License + for System Z Authorized User Single Install FROM Security AppScan Enterprise Reporting Only User per Authorized User Single Install Trade Up License + for System Z FROM Security AppScan Enterprise Dynamic Analysis User Authorized User Single Install Trade Up License + for System Z FROM Security AppScan Enterprise Reporting Only User Trade Up License + Server for System Z Install FROM Security AppScan Enterprise Server Basic Per Install Trade Up License + for System z Authorized User Single Install FROM Security AppScan Source for Remediation Per Authorized User Single Install Trade Up License + for System z FROM Security AppScan Source for Remediation per Trade Up License + for System z FROM Security AppScan Source for Development Authorized User Single Install Trade Up License + IBM Security AppScan Source for Remediation for System z FROM Security AppScan Source for Remediation Authorized User Single Install Trade Up License + IBM Security AppScan Source for Analysis for System z FROM Security AppScan Source for Analysis Authorized User Single Install Trade Up License + IBM Security AppScan Standard FROM IBM Security AppScan Standard Auth User Single Install Trade-up License + IBM Security AppScan Standard for System Z FROM IBM Security AppScan Standard Auth User Single Install Trade-up License + Consult your IBM representative if you have any questions. D0L78LL D0L6WLL D0L6VLL D0L72LL D0L6LLL D0CHVLL D0CI0LL D0CHZLL D0CIDLL D0CHRLL D053YLL D053XLL IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 22

23 Passport Advantage customer: Media pack entitlement details Customers with active maintenance or subscription for the products listed are entitled to receive the corresponding media pack. Description and Remediation V8.8 Multilingual, DVD Media Pack IBM Security AppScan Source for Analysis V8.8 Multilingual, DVD Media Pack IBM Security AppScan Source for Automation V8.8 Multilingual, DVD Media Pack Server V8.8 ML Multilingual, DVD Media Pack IBM Security AppScan Standard V8.8 Multilingual, DVD Media Pack Dynamic Analysis Scanner V8.8 Multilingual, DVD Media Pack Part number BT012ML BT011ML BT010ML BT0KCML BJ13VML BT0KDML Charge metric PID Program name number Charge metric IBM Security AppScan Enterprise V8.8 Dynamic Analysis Users IBM Security AppScan Enterprise V8.8 Dynamic Analysis Scanner 5724-T52 Authorized User Single Install 5724-T52 Install IBM Security AppScan Source 5724-Z34 Install for Automation V8.8 IBM Security AppScan Source 5724-Z35 Authorized User Single Install for Analysis V8.8 IBM Security AppScan Source 5724-Z36 Authorized User Single Install for Development V8.8 IBM Security AppScan Source 5724-Z37 Authorized User Single Install for Remediation V8.8 IBM Security AppScan Standard V8.8 Authorized User 5724-T59 Authorized User Single Install Authorized User is a unit of measure by which the program can be licensed. An Authorized User is a unique person who is given access to the program. The program may be installed on any number of computers or servers and each Authorized User may have simultaneous access to any number of instances of the program at one time. Licensee must obtain separate, dedicated entitlements for each Authorized User given access to the program in any manner directly or indirectly (for example, via a multiplexing program, device, or application server) through any means. An entitlement for an Authorized User is unique to that Authorized User and may not be shared, nor may it be reassigned other than for the permanent transfer of the Authorized User entitlement to another person. Note: Some programs may be licensed where devices are considered users. In that case, the following applies. Any computing device that requests the execution of or receives for execution a set of commands, procedures, or applications from the program or that is otherwise managed by the program is considered a separate user of the program and requires an entitlement as if that device were a person. IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 23

24 Floating User Floating User is a unit of measure by which the program can be licensed. A Floating User is a person who is accessing the program at any particular point in time. An install is an installed copy of the program on a physical or virtual disk made available to be executed on a computer. The program may be installed on any number of computers or servers, but if the Floating User simultaneously accesses more than one install of the program, the Floating User requires a separate entitlements for each such install. Licensee must obtain separate entitlements for each Floating User simultaneously accessing the program on each install in any manner directly or indirectly (for example, via a multiplexing program, device, or application server) through any means. Note: Some programs may be licensed where devices are considered users. In that case, the following applies. Any computing device that requests the execution of or receives for execution a set of commands, procedures, or applications from the program or that is otherwise managed by the program is considered a separate user of the program and requires an entitlement as if that device were a person. Terms and conditions The information provided in this announcement letter is for reference and convenience purposes only. The terms and conditions that govern any transaction with IBM are contained in the applicable contract documents such as the IBM International Program License Agreement, IBM International Passport Advantage Agreement, and the IBM Agreement for Acquisition of Software Maintenance. This product is only available via Passport Advantage. It is not available as shrinkwrap. Licensing IBM International Program License Agreement including the License Information document and Proof of Entitlement (PoE) govern your use of the program. PoEs are required for all authorized use. Part number products only, offered outside of Passport Advantage, where applicable, are license only and do not include Software Maintenance. This software license includes Software Subscription and Support (also referred to as Software Maintenance). These programs are licensed under the IBM Program License Agreement (IPLA) and the associated Agreement for Acquisition of Software Maintenance, which provide for support with ongoing access to releases and versions of the program. IBM includes one year of Software Subscription and Support (also referred to as Software Maintenance) with the initial license acquisition of each program acquired. The initial period of Software Subscription and Support (also referred to as Software Maintenance) can be extended by the purchase of a renewal option, if available. These programs have a one-time license charge for use of the program and an annual renewable charge for the enhanced support that includes telephone assistance (voice support for defects during normal business hours), as well as access to updates, releases, and versions of the program as long as support is in effect. License Information form number (5724-T52): L-KKHS-978KDU, L-KKHS-978KX5 IBM Security AppScan Source for Automation (5724-Z34): L-NLII-98MR5U (5724-Z36): L-NLII-98MR5U IBM Security AppScan Source for Remediation (5724-Z37): L-NLII-98MR5U IBM Security AppScan Source for Analysis (5724-Z35): L-NLII-98MR5U IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 24

25 IBM Security AppScan Standard (5724-T59): L-KKHS-978KC9 The program's License Information will be available for review on the IBM Software License Agreement website Limited warranty applies Yes Limited warranty IBM warrants that when the program is used in the specified operating environment, it will conform to its specifications. The warranty applies only to the unmodified portion of the program. IBM does not warrant uninterrupted or error-free operation of the program or that IBM will correct all program defects. You are responsible for the results obtained from the use of the program. IBM provides you with access to IBM databases containing information on known program defects, defect corrections, restrictions, and bypasses at no additional charge. For further information, consult the IBM Software Support Handbook found at IBM will maintain this information for at least one year after the original licensee acquires the program (warranty period). Program technical support This technical support allows you to obtain assistance (via telephone or electronic means) from IBM for product-specific, task-oriented questions regarding the installation and operation of the program product. Software Subscription and Support (Software Maintenance) also provides you with access to updates (modifications or fixes), releases, and versions of the program. You will be notified, via announcement letter, of discontinuance of support with 12 months' notice. If you require additional technical support from IBM, including an extension of support beyond the discontinuance date, contact your IBM representative or IBM Business Partner. This extension may be available for a fee. Money-back guarantee If for any reason you are dissatisfied with the program and you are the original licensee, you may obtain a refund of the amount you paid for it, if within 30 days of your invoice date you return the program and its PoE to the party from whom you obtained it. If you downloaded the program, you may contact the party from whom you acquired it for instructions on how to obtain the refund. For clarification, note that (1) for programs acquired under the IBM International Passport Advantage offering, this term applies only to your first acquisition of the program and (2) for programs acquired under any of IBM's On/Off Capacity on Demand (On/Off CoD) software offerings, this term does not apply since these offerings apply to programs already acquired and in use by you. Other terms Volume orders (IVO) No IBM Latin America Software Announcement LP IBM is a registered trademark of International Business Machines Corporation 25