HPE Security Fortify Software

Transcription

1 HPE Security Software Software Version: System Requirements Document Release Date: November 2017 Software Release Date: November 2017

2 Legal Notices Warranty The only warranties for Seattle SpinCo, Inc. and its subsidiaries' ( Seattle ) products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Seattle shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Except as specifically indicated, valid license from Seattle required for possession, use or copying. Consistent with FAR and , Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice Copyright EntIT Software LLC, a Micro Focus company Trademark Notices Adobe is a trademark of Adobe Systems Incorporated. Microsoft and Windows are U.S. registered trademarks of Microsoft Corporation. UNIX is a registered trademark of The Open Group. Documentation Updates The title page of this document contains the following identifying information: Software Version number Document Release Date, which changes each time the document is updated Software Release Date, which indicates the release date of this version of the software To check for recent updates or to verify that you are using the most recent edition of a document, go to: You will receive updated or new editions if you subscribe to the appropriate product support service. Contact your Micro Focus sales representative for details. HPE Security Software (17.20) Page 2 of 44

3 Contents Preface 6 Contacting HPE Security Support 6 For More Information 6 About the Documentation Set 6 Introduction 7 Software Delivery 7 Software Licenses 7 Software Security Center Server Requirements 7 Hardware Requirements 7 Database 8 Database Performance Metrics for Minimum and Recommended Hardware Requirements 8 Platforms and Architectures 8 Application Servers 9 Software Security Center Database 9 Browsers 10 Authentication Systems 11 Single Sign-On (SSO) 11 BIRT Reporting 11 Service Integrations 12 Static Code Analyzer Requirements 12 Hardware Requirements 12 Software Requirements 12 Platforms and Architectures 13 Supported Languages 14 Build Tools 15 Compilers 15 Secure Code Plugins 16 Single Sign-On (SSO) 17 Service Integrations for Static Code Analyzer Tools 17 Security Content 17 CloudScan Requirements 17 CloudScan Controller Hardware Requirements 18 CloudScan Controller Platforms and Architectures 18 CloudScan Client and Sensor Hardware Requirements 18 Runtime Requirements 19 Platforms and Architectures 19 Java Runtime Environments 19 Java Application Servers 19.NET Frameworks 20 Cloud Platforms 20 HPE Security Software (17.20) Page 3 of 44

4 IIS for Windows Server 20 Cipher Suites for Runtime Agent 20 Requirements 21 Running as Administrator 21 Hardware Requirements 21 Software Requirements 21 Notes on SQL Server Editions 22 Ports and Protocols 23 Required Connections 23 Optional Connections 23 Connections for Tools 26 Agent 26 Software Development Kit (SDK) 26 Software Integrations for 26 Enterprise Requirements 27 Enterprise Installation and Upgrade Requirements 27 Integrations for Enterprise 27 Enterprise Database 27 Hardware Requirements 28 Software Requirements 28 Enterprise Administrative Console Requirements 29 Hardware Requirements 29 Software Requirements 30 Ports and Protocols 30 Required Connections 31 Optional Connections 32 Connections for Tools 33 Enterprise Sensor 33 Enterprise Notes and Limitations 34 License Infrastructure Manager Requirements 34 Hardware Requirements 34 Software Requirements 35 Version Compatibility Matrix 35 Software Component Compatibility 35 FPR File Compatibility 36 Software Security Center Support for Runtime Configuration Bundle and Template 36 Virtual Machine Support 36 Technologies and Features no Longer Supported in this Release 37 Technologies and Features to Lose Support in the Next Release 37 Acquiring Software 38 Downloading Software 41 About Verifying Software Downloads 42 Preparing Your System for Digital Signature Verification 42 Verifying Software Downloads 42 Assistive Technologies (Section 508) 43 HPE Security Software (17.20) Page 4 of 44

5 Send Documentation Feedback 44 HPE Security Software (17.20) Page 5 of 44

6 Preface Contacting HPE Security Support If you have questions or comments about using this product, contact HPE Security Technical Support using one of the following options. To Manage Your Support Cases, Acquire Licenses, and Manage Your Account To Support To Call Support For More Information For more information about HPE Security software products: About the Documentation Set The HPE Security Software documentation set contains installation, user, and deployment guides for all HPE Security Software products and components. In addition, you will find technical notes and release notes that describe new features, known issues, and last-minute updates. You can access the latest versions of these documents from the following Product Documentation website: You will need to register for an account. HPE Security Software (17.20) Page 6 of 44

7 Introduction This document provides the details about the environments and products that HPE supports for this version of Software and its associated products, which includes: Software Security Center Server Static Code Analyzer Audit Workbench and Secure Code Plugins CloudScan Runtime Enterprise License Infrastructure Manager Software Delivery Software is delivered only electronically. It is not available on disc. See "Acquiring Software" on page 38 for more information. Software Licenses Before you can start using Software, you must download the licenses for your purchases from the Customer Portal ( To access the site, use the credentials that HPE Security Customer Support has provided. Software Security Center Server Requirements This section describes the system requirements for the Software Security Center server. Hardware Requirements Software Security Center requires the hardware specifications listed in the following table. Component Minimum Recommended Software Security Center Processor Quad-core Eight-core RAM 8 GB 32 GB Software Security Center server Java Heap Size 4 GB 24 GB HPE Security Software (17.20) Page 7 of 44

8 Database HPE recommends an eight-core processor with 64 GB of RAM for the Software Security Center database. Using less than this recommendation can impact Software Security Center performance. Use the following formula to estimate the size (in GB) of the Software Security Center database disk space: ((<Total_Issues>*30 KB) + <Total_Artifacts>) 1,000,000 where: <Total_Issues> is the total number of issues in the system <Total_Artifacts> is the total size in KB of all uploaded artifacts and scan results Note: This equation produces only a rough estimate for database disk space allocation. Do not use this formula to estimate disk space requirements for long-term projects. Disk requirements for Software Security Center databases increases in proportion to the number of projects, scans, and issues in the system. Database Performance Metrics for Minimum and Recommended Hardware Requirements The following table shows performance metrics (number of issues discovered per hour) for Software Security Center configured with the minimum and the recommended hardware requirements. Database Issues per Hour Minimum Configuration Issues per Hour Recommended Configuration IBM DB2 293,930 1,812,570 MySQL 362,514 2,589,385 Oracle Database 231,392 3,020,950 SQL Server 725,028 3,625,140 Platforms and Architectures Software Security Center supports the platforms and architectures listed in the following table. Operating System Architectures Versions Windows 64-bit Server 2016 Server 2012 R2 HPE Security Software (17.20) Page 8 of 44

9 Operating System Architectures Versions Linux 64-bit Red Hat Enterprise Linux 6 update 5 and later Red Hat Enterprise Linux 7.x Oracle Linux 6 update 5 and later Oracle Linux 7.x SUSE Linux Enterprise Server 12 Note: Although Software Security Center has not been tested on all Linux variants, most distributions are not known to have issues. Application Servers Software Security Center supports the application servers listed in the following table. Application Server Versions Java Versions Apache Tomcat 8.0, IBM WebSphere Oracle WebLogic 12c Software Security Center Database Software Security Center requires that all database schema collations be case-sensitive. For a production environment, Software Security Center supports the databases listed in the following table. Databases Version Supported Character Sets Drivers IBM DB fixpack 6 UTF8, IBM-1252 IBM DB2 drivers also require that you add at least one of the following driver license files to the CLASSPATH before you load the JDBC driver and seed the database: db2jcc_license_cisuz.jar db2jcc_license_cu.jar IBM DB2 JDBC Driver v10.5 Driver class: com.ibm.db2.jcc.db2driver HPE Security Software (17.20) Page 9 of 44

10 Databases Version Supported Character Sets Drivers JAR file: db2jcc4.jar MySQL 5.6 Oracle Database 5.7 (Community Edition) 12c Release 1 12c Release 2 SQL Server utf8_bin, latin1_general_ cs AL32UTF8 for all languages WE8MSWIN1252 for US English AL32UTF8 for all languages WE8MSWIN1252 for US English Make sure to use the case-sensitive (CS) option when choosing your collation method. For example: SQL_Latin1_ General_CP1_CS_ AS or later Driver class: com.mysql.jdbc.driver JAR file: mysql-connector-java- <version>-bin.jar Oracle Database 12c Release 1 (12.1) JDBC Drivers Driver class: oracle.jdbc.oracledriver JAR files: ojdbc7.jar (for Java 7 or later) Oracle Database 12c Release 2 (12.2.x) JDBC Drivers Driver class: oracle.jdbc.oracledriver JAR files: ojdbc8.jar (for Java 8) Microsoft JDBC Driver 6.0 for SQL Server Driver class: com.microsoft.sqlserver. jdbc.sqlserverdriver JAR file: sqljdbc42.jar Browsers HPE recommends that you use one of the browsers listed in the following table and a minimum screen resolution of 1280 x Browser Google Chrome Version 59.0 or later HPE Security Software (17.20) Page 10 of 44

11 Browser Version Microsoft Edge 20 Internet Explorer 11 Mozilla Firefox 54.0 or later Safari 10 Note: To use the Software Security Center 4.30 legacy user interface, you must have Adobe Flash Player installed. Authentication Systems Software Security Center supports the following directory services: LDAP: LDAP 3 compatible Windows Active Directory Service Single Sign-On (SSO) Software Security Center supports: HTTP SSO (Oracle SSO, CA SSO) SAML SSO SPNEGO/Kerberos SSO PKI SSO (X.509) CAS SSO BIRT Reporting Software Security Center reports support Business Intelligence and Reporting Technology (BIRT) version HPE Security Software (17.20) Page 11 of 44

12 Service Integrations Software Security Center supports the service integrations listed in the following table. Service Applications Versions Bug tracking Bugzilla 5.0 HPE Application Lifecycle Management (ALM)/ Quality Center Enterprise (QC) JIRA 7.1, 7.4 Team Foundation Server (TFS) 2015, 2017 Visual Studio Team Services (VSTS) n/a Note: Only basic user password authentication is supported. Authentication Active Directory 2008, 2012 Dynamic assessments Enterprise Static Code Analyzer Requirements This section describes the system requirements for Static Code Analyzer, and the Static Code Analyzer Tools (including the Secure Code Plugins). Hardware Requirements HPE recommends that you install Static Code Analyzer on a high-end processor with at least 8 GB of RAM. If your software is complex, you might require more RAM. See the HPE Security Static Code Analyzer Performance Guide for more information. Increasing the number of processor cores and increasing memory both result in faster processing. Software Requirements Static Code Analyzer requires Java 8. The SCA and Applications installer installs JRE 1.8.0_144. HPE Security Software (17.20) Page 12 of 44

13 Platforms and Architectures Static Code Analyzer supports the platforms and architectures listed in the following table. Operating System Architecture Platforms Windows 64-bit Windows Server 2016 Windows Server 2012 R2 Windows 8.1, 10 Linux 64-bit Red Hat Enterprise Linux 6 update 5 and later macos Red Hat Enterprise Linux 7.x Oracle Linux 6 update 5 and later Oracle Linux 7.x Oracle Solaris x86, 64-bit 10.5 and later Oracle Solaris SPARC 64-bit 10.5 and later HP-UX Itanium 64-bit IBM AIX 64-bit 6.1, 7.2 SUSE Linux Enterprise Server 12 Static Code Analyzer Tools (including Secure Code Plugins) support the platforms and architectures listed in the following table. Operating System Architecture Platforms Windows 64-bit Windows 7, 8.1, 10 Linux 64-bit Red Hat Enterprise Linux 6 update 5 and later macos Red Hat Enterprise Linux 7.x Oracle Linux 6 update 5 and later Oracle Linux 7.x SUSE Linux Enterprise Server 12 HPE Security Software (17.20) Page 13 of 44

14 Supported Languages Static Code Analyzer supports the programming languages listed in the following table. Language Versions.NET ABAP/BSP 6 ActionScript 3.0 Apex 36 ASP.NET C# 5, 6, 7 C/C++ Classic ASP (with VBScript) COBOL See "Compilers" on the next page 2.0, 3.0 IBM Enterprise COBOL for z/os with CICS, IMS, DB2 embedded SQL, and IBM MQ ColdFusion 8, 9, 10 HTML Java (including Android) 5 and earlier 5.0, 6, 7, 8, 9 JavaScript ECMAScript 2015 JSP 1.2, 2.1 MXML (Flex) 4 Objective-C/C++ See "Compilers" on the next page PHP 5.3, 5.4, 5.5, 5.6, 7.0, 7.1 PL/SQL Python 2.6, 2.7 Ruby Scala 2.11, 2.12 Swift 3.0.2, 3.1 HPE Security Software (17.20) Page 14 of 44

15 Language Versions T-SQL SQL Server 2005, 2008, 2012 VB.NET 11, 14, 15 VBScript 2.0, 5.0 Visual Basic 6 XML 1.0 Build Tools Static Code Analyzer supports the build tools listed in the following table. Build Tool Versions Notes Ant Gradle 2.13 The Static Code Analyzer Gradle build integration supports the following language/platform combinations: Jenkins 1.6 Java/Windows, Linux, and macos C/Linux C++/Linux Maven 3.0.5, 3.3.x MSBuild 4.x, 12.0, 14.0, 15.0 Xcodebuild 8.0, 8.1, 8.2, 8.3 Compilers Static Code Analyzer supports the compilers listed in the following table. Compiler Versions Platform gcc GNU gcc 4.9, 5.x Windows, Linux, macos, Solaris, IBM AIX gcc GNU gcc and later HP-UX g++ GNU g++ 4.9, 5.x Windows, Linux, macos, Solaris, IBM AIX HPE Security Software (17.20) Page 15 of 44

16 Compiler Versions Platform g++ GNU g and later HP-UX Intel C++ Compiler icc 8.0 Linux Oracle javac 7, 8. 9 Windows, Linux, macos, Solaris, HP-UX, IBM AIX Oracle Solaris Studio 12 Solaris cl 2013, 2015, 2017 Windows Apple LLVM (Clang) 8.0, 8.1, 8.2, 8.3 macos Swiftc 3.0.2, 3.1 macos Secure Code Plugins The following table lists the supported integrated development environments (IDE) for the Secure Code Plugins. Plugin Eclipse (Complete and Remediation) IDE and Version Eclipse 4.6, 4.7 IntelliJ IDEA Analysis IntelliJ IDEA 15, 2016.x, 2017.x Android Studio 2.3.x IntelliJ IDEA Remediation IntelliJ IDEA 15, 2016.x, 2017.x Android Studio 2.3.x WebStorm 2017.x JDeveloper Remediation Extension Security Assistant (for Java code only) Visual Studio Package JDeveloper 12c Eclipse 4.6, 4.7 Visual Studio 2013 Premium, Professional, and Ultimate Visual Studio 2015 Community, Professional, and Enterprise Visual Studio 2017 Community, Professional, and Enterprise Note: Static Code Analyzer is not compatible with Visual Studio Express. HPE Security Software (17.20) Page 16 of 44

17 Single Sign-On (SSO) The Eclipse Complete plugin and the Visual Studio Package support the following SSO methods to connect with Software Security Center: SPNEGO/Kerberos SSO PKI SSO (X.509) Service Integrations for Static Code Analyzer Tools The following table lists the supported service integrations for Audit Workbench and the Secure Code Plugins. Service Versions Supported Tools Bugzilla 5.0 Audit Workbench, Eclipse Plugin, Visual Studio Package HPE Application Lifecycle Management (ALM)/ Quality Center Enterprise (QC) Audit Workbench, Eclipse Plugin Team Foundation Server (TFS) 2013 Visual Studio Package Visual Studio Team Services (VSTS) Note: Only basic user password authentication is supported. 2015, 2017 n/a Audit Workbench, Eclipse Plugin, Visual Studio Package Audit Workbench, Eclipse Plugin JIRA 7.1, 7.4 Audit Workbench, Eclipse Plugin Software Security Center Bugtracker Audit Workbench, Eclipse Plugin, Visual Studio Package Security Content Secure Coding Rulepacks are backward compatible with all supported Software versions. This ensures that Rulepacks updates do not break any working Software installation. CloudScan Requirements CloudScan has three major components: a CloudScan Controller, CloudScan clients, and CloudScan sensors. This section describes the requirements for each component. HPE Security Software (17.20) Page 17 of 44

18 CloudScan Controller Hardware Requirements HPE recommends that you install the CloudScan Controller on a high-end 64-bit processor running at 2 GHz with at least 8 GB of RAM. CloudScan Controller Disk Space Requirements To estimate the amount of disk space required on the machine that runs the CloudScan Controller, use the following equation: <Number_Jobs_Per_Day> x (<Average_MBS_Size> + <Average_FPR_Size> + <Average_SCA_Log_ Size>) x <Number_Days_Data_is_Persisted> By default, data is persisted for seven days. CloudScan Controller Platforms and Architectures The CloudScan Controller supports the platforms and architectures listed in the following table. Operating System Architectures Versions Windows 64-bit Server 2016 Server 2012 R2 Linux 64-bit Red Hat Enterprise Linux 6 update 5 and later Red Hat Enterprise Linux 7.x Oracle Linux 6 update 5 and later Oracle Linux 7.x SUSE Linux Enterprise Server 12 CloudScan Client and Sensor Hardware Requirements CloudScan clients and sensors run on any machine that supports Static Code Analyzer. Because CloudScan clients and sensors are installed on build machines running Static Code Analyzer, the hardware requirements are met. See " Static Code Analyzer Requirements" on page 12 for hardware, software, and platform and architecture requirements. HPE Security Software (17.20) Page 18 of 44

19 CloudScan Sensor Disk Space Requirements To estimate the amount of disk space required on the machine that runs a CloudScan sensor, use the following equation: <Number_of_Scans> x (<Average_MBS_Size> + <Average_FPR_Size> + <Average_SCA_Log_Size>) x <Number_Days_Data_is_Persisted> By default, data is persisted for seven days. Runtime Requirements Runtime is delivered as separate install images for Runtime Application Protection, ArcSight Application View, and Agent. Platforms and Architectures Runtime supports 32-bit and 64-bit applications written in Java 5, 6, 7, and 8. Java Runtime Environments Runtime supports the Java runtime environments listed in the following table. JRE IBM J9 Major Versions 5 (SR10 and later) 6 (SR6 and later) Oracle HotSpot 5, 6, 7, 8 Oracle JRockit 5, 6 (R27.6 and later) Note: Runtime for Java is supported on Unix, Linux, and Windows. Java Application Servers Runtime supports the Java application servers listed in the following table. Application Server Versions Apache Tomcat 6.0, 7.0, 8.0 IBM WebSphere 7.0, 8.0, 8.5, Oracle WebLogic 10.0, 10.3, 11g, 11gR1, 12c HPE Security Software (17.20) Page 19 of 44

20 Application Server Versions Red Hat JBoss Enterprise Application Platform 5.1.2, 5.2.0, 6.0.1, 6.1.1, 6.2.0, 6.30, 6.40 Jetty 9.3 WildFly 10.1.NET Frameworks Runtime supports.net frameworks versions 2.0, 3.0, 3.5, 4.0, 4.5, and Cloud Platforms Runtime supports the cloud platforms listed in the following table. Cloud Platform Amazon Web Services Microsoft Azure Service Virtual machines without a sandboxed environment Virtual machines and cloud services Note: Microsoft Azure platform as a service (PaaS) is not supported. IIS for Windows Server Runtime supports Internet Information Services (IIS) versions 6.0, 7.0, 7.5, 8 and 8.5. Cipher Suites for Runtime Agent Runtime Agent supports the following cipher suites for communicating with an external syslog server: TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA256 To run Runtime Agent on a Windows 2003 machine with IIS 6.0, you must install the Advanced Encryption Standard (AES) cipher suites in the Schannel.dll module for Windows server Download the hotfix from Microsoft support ( HPE Security Software (17.20) Page 20 of 44

21 Requirements Before you install, make sure that your system meets the requirements described in this section. Running as Administrator requires administrative privileges for proper operation of all features. Refer to the Windows operating system documentation for instructions on changing the privilege level to run as an administrator. Hardware Requirements HPE recommends that you install on a system that conforms to the supported components listed in the following table. Beta or pre-release versions of operating systems, service packs, and required third-party components are not supported. Component Requirement Notes Processor 2.5 GHz quad-core or faster Recommended 2.0 GHz dual-core Minimum RAM 8+ GB (2 GB per core) Recommended 4 GB Minimum Hard disk 100+ GB Recommended 40 GB Minimum Display 1980 x 1080 Recommended 1280 x 1024 Minimum Important: If you are running a sensor with SQL Express, HPE recommends that you use at least a 4-core CPU and a 64-bit operating system with at least 8 GB of RAM. Software Requirements runs on and works with the software packages listed in the following table. Note: is available in both 32-bit and 64-bit installation versions. HPE Security Software (17.20) Page 21 of 44

22 Package Versions Notes Windows Windows 10 Recommended Windows 7 with SP1 Windows 8 or 8.1 Windows Server 2012, 2012 R2 Windows Server 2016.NET.NET Framework SQL Server SQL Server 2012 with SP2 Recommended No scan database limit SQL Server 2008 R2 with SP2 SQL Server 2012 with SP1 SQL Server 2014 with SP1 SQL Server 2016 No scan database limit No scan database limit No scan database limit SQL Server Express SQL Server 2014 Express with SP1 Recommended 10 GB scan database limit SQL Server 2012 Express with SP1 or SP2 SQL Server 2016 Express 10 GB scan database limit 10 GB scan database limit Browser Internet Explorer 11 Recommended Internet Explorer 10 Portable Document Format Adobe Acrobat Reader 11 Recommended Adobe Acrobat Reader Minimum Notes on SQL Server Editions When using the Express edition of SQL Server: Scan data must not exceed the database size limit. If you require a larger database or you need to share your scan data, use the full version of SQL Server. During the installation you might want to enable Hide advanced installation options. Accept all default settings. requires that the default instance is named SQLEXPRESS. HPE Security Software (17.20) Page 22 of 44

23 When using the full edition of SQL Server: You can install the full version of SQL Server on the local host or nearby (co-located). You can configure this option in the Application Settings (Edit > Application Settings > Database). Ports and Protocols This section describes the ports and protocols uses to make required and optional connections. Required Connections The following table lists the ports and protocols uses to make required connections. Direction Endpoint URL or Details Port Protocol Notes to target host to SQL database to Certificate Revocation List (CRL) Target host Scan target host Any HTTP must connect to the web application or web service to be scanned. MS SQL Express or MS SQL Standard/Enterprise Verisign CRL SQLEXPRESS service on localhost or SQL TCP service locally installed or remote host pca3.crl or crl.verisign.com/ CSC crl 1433 SQL TCP Used for maintaining the scan data and generating reports within the application. 80 HTTP Offline installations of or Enterprise require you to manually download and apply the CRL from Verisign. products prompt for these lists from Windows and their absence can cause problems with the application. A one-time download is sufficient, but HPE recommends regularly repeating this CRL download process as part of regular maintenance. Optional Connections The following table lists the ports and protocols uses to make optional connections. Direction Endpoint URL or Details Port Protocol Notes to HPE License activation server Remote HPE Licensing Service HTTPS For one-time activation of a Named User license. You may optionally use the following: HPE Security Software (17.20) Page 23 of 44

24 Direction Endpoint URL or Details Port Protocol Notes An offline activation process instead of using this direct connection Upstream proxy with authentication instead of a direct connection to SmartUpdate server Remote SmartUpdate service HTTPS Used to automatically update the product. SmartUpdate is automatic when opening the product UI, but can be disabled and run manually. Can optionally use upstream proxy with authentication instead of a direct connection. to HPE Support Channel server Remote HPE Support Channel service HTTPS Used to retrieve product marketing messages and to upload data or product suggestions to HPE Security Support. Message check is automatic when opening the product UI, but can be disabled and run manually. Can optionally use upstream proxy with authentication instead of a direct connection. to HPE Telemetry server Remote HPE Telemetry and performance reporting service Note: Accessing this URL in a browser does not display any content. 443 HTTPS The Telemetry service provides an automated process for collecting and sending usage information to HPE. HPE software developers use this information to help improve the product. to License and Infrastructure Manager (LIM) HPE LIM (Local Licensing Service) Lease Concurrent User license 443 Web services Required for client to lease and use a Concurrent User license maintained in a LIM license pool. You can detach the client license from LIM after activation to avoid a constant connection. API listener Local machine API, or network IP or userspecified HTTP Use to activate a API Windows Service. This HPE Security Software (17.20) Page 24 of 44

25 Direction Endpoint URL or Details Port Protocol Notes address opens a listening port on your machine, which you can use locally or remotely to generate scans and retrieve the results programmatically. This API can be SSL enabled, and supports Basic or Windows authentication. to Enterprise Enterprise server User-specified server 443 or userspecified HTTP or HTTPS The Enterprise Server menu connects as a client to the enterprise security solution to transfer findings and user role and permissions management. sensor service to Enterprise Enterprise server User-specified server 443 or userspecified HTTP or HTTPS Separate from the UI, you can configure the local installation as a remote scan engine for use by the enterprise security solution community. This is done through a Windows Service. This constitutes a different product from desktop and is recommended to be run on its own, non-userfocused machine. Browser to localhost Manual Step-Mode Scan Dynamic, 8081, or userspecified HTTP or HTTPS serves as a web proxy to the browser, enabling manual testing of the target web server through. to Quality Center Enterprise (ALM) QC server User-specified ALM server Serverspecified HTTP or HTTPS Permits submission of findings as defects to the ALM bug tracker application. HPE Security Software (17.20) Page 25 of 44

26 Connections for Tools The following table lists the ports and protocols that the tools use to make connections. Tool Direction Endpoint Port Protocol Notes Web Proxy To target host localhost 8080 or userspecified HTTP or HTTPS Intercepts and displays web traffic Web Form Editor To target host localhost Dynamic, 8100, or userspecified HTTP or HTTPS Intercepts web traffic and captures submitted forms Login or Workflow Macro Recorders To target host localhost Dynamic, 8081, or userspecified HTTP or HTTPS Records browser sessions for replay during scan Web Discovery machine to targeted IP range Target host network range Userspecified range HTTP and HTTPS Scanner for identifying rogue web applications hosted among the targeted scanned IP and port ranges Use to provide targets to (manually) Agent For system requirements, see " Runtime Requirements" on page 19. Software Development Kit (SDK) The SDK requires the following software: Visual Studio 2013 or 2015.NET Framework Important: Visual Studio Express versions do not support third-party extensions. Therefore, these versions do not meet the software requirements for using the SDK. Software Integrations for The following table lists products that you can integrate with. Product Versions Enterprise HPE Application Lifecycle Management (ALM) 11.5, 12.01, 12.21, HPE Security Software (17.20) Page 26 of 44

27 Product Versions Note: You must also install the ALM Connectivity tool to connect to ALM. Software Security Center HPE Unified Functional Testing 11.5 Enterprise Requirements Before you install Enterprise, make sure that your systems meet the requirements described in this section. Note: Product versions that are not specifically listed in this document are not supported. Enterprise Installation and Upgrade Requirements You can upgrade directly from Enterprise to Enterprise You cannot upgrade directly from any other versions of Enterprise. For detailed information about upgrades, see the HPE Security Enterprise Installation and Implementation Guide. Integration with Software Security Center is optional. If you are integrating Enterprise with Software Security Center, then you must install and run Software Security Center before you install a new instance of Enterprise or upgrade from Enterprise You can install Software Security Center and Enterprise on the same or different machines. Using separate machines might improve performance. Integrations for Enterprise You can integrate Enterprise with the following components: sensors Agent Enterprise Database HPE recommends that you configure the database server on a separate machine from either Software Security Center or Enterprise. The Enterprise Server SQL database requires case-insensitive collation. HPE Security Software (17.20) Page 27 of 44

28 Important: This is opposite the requirement for Software Security Center databases as described in " Software Security Center Database" on page 9. Hardware Requirements The following table lists the hardware requirements for the Enterprise server. Component Requirement Notes Processor 3.0 GHz quad-core or faster Recommended 2.5 GHz dual-core Minimum RAM 8+ GB (2 GB per core) Recommended 4 GB Minimum Hard disk 100+ GB Recommended 20+ GB if using a local database 5 GB if using a remote database Display 1920 x 1080 Recommended 1280 x 1024 Minimum Software Requirements Enterprise server runs on and works with the software packages listed in the following table. Package Versions Notes Windows Windows Server 2012 R2 Recommended Windows Server 2012 Windows Server 2016.NET.NET Framework Platform IIS 8.5 Recommended IIS 7.5 IIS 8.0 IIS 10 SQL Server SQL Server 2014 with SP1 Recommended HPE Security Software (17.20) Page 28 of 44

29 Package Versions Notes No scan database limit SQL Server 2012 with SP1 or SP2 SQL Server 2016 No scan database limit No scan database limit Browser Internet Explorer 11 Recommended Mozilla Firefox 51.0 or Recommended Mozilla Firefox Plugins for Enterprise Servers For Software Security Center: Adobe Flash Player For Enterprise: Silverlight 5.0 or 5.1 Enterprise Administrative Console Requirements This section describes the hardware and software requirements for the Enterprise Administrative Console. You do not need to install the Enterprise Administrative Console on the same machine as the Web Console of the Enterprise server. The two consoles have different system requirements. In addition, you can install multiple Administrative Consoles on different machines connected to the same Enterprise server. Hardware Requirements The following table lists the hardware requirements for Enterprise Administrative Console. Component Requirement Notes Processor 2.5 GHz dual-core Minimum RAM 4 GB Minimum 1 You cannot perform a Guided Scan or create reports using the Mozilla Firefox browser. This browser no longer supports the.net Framework Assistant plugin. HPE Security Software (17.20) Page 29 of 44

30 Component Requirement Notes Hard disk 2 GB Display 1980 x 1080 Recommended 1280 x 1024 Minimum Software Requirements The Enterprise Administrative Console runs on and works with the software packages listed in the following table. Note: The Enterprise Administrative Console is available in both 32-bit and 64-bit installation versions. Package Versions Notes Windows Windows 10 Recommended Windows 7 with SP1 Windows 8 or 8.1 Windows Server 2016 Windows Server 2012 or 2012 R2.NET.NET Framework Ports and Protocols This section describes the ports and protocols Enterprise uses to make required and optional connections. HPE Security Software (17.20) Page 30 of 44

31 Required Connections The following table lists the ports and protocols Enterprise uses to make required connections. Direction Endpoint URL or Details Port Protocol Notes Enterprise Manager server to SQL database MS SQL Standard/Enterprise SQL TCP service on locally installed or remote host 1433 or userspecified SQL TCP Used to maintain the scan data and full Enterprise environment. Custom configurations of MS SQL are permitted, including port changes and encrypted communication. Enterprise Manager machine to Software Security Center server Software Security Center server User-specified Software Security Center server 8180 or userspecified HTTP or HTTPS As a modular addon, Enterprise requires a connection to its core Software Security Center server. Note: This connection is required only if you integrate Enterprisewith Software Security Center. Sensor machines to Enterprise Manager server Enterprise server User-specified Enterprise server 443 or userspecified HTTPS Communication is two-way HTTP traffic, initiated inbound by the sensor machine. Browser users to Enterprise server UI Enterprise server User-specified Enterprise server 443 or userspecified HTTPS You can configure Enterprise not to use SSL, but tests indicate that it might affect the usability of the product. Browser user to Software Security Center UI Software Security Center server User-specified Software Security Center server 8180 or userspecified HTTP or HTTPS You can configure the Software Security Center server on any available port during HPE Security Software (17.20) Page 31 of 44

32 Direction Endpoint URL or Details Port Protocol Notes Enterprise Manager machine to SmartUpdate server SmartUpdate HTTPS installation. Used to acquire updates for the product as well as all connected clients ( sensors and desktop). The administrator manually runs SmartUpdate, however HPE recommends that you set up an automated schedule. New client releases are held in reserve until the Enterprise administrator marks them as Approved, at which time they are automatically distributed from the Enterprise Manager server. Can support the use of an upstream proxy with authentication instead of a direct Internet connection. Optional Connections The following table lists the ports and protocols Enterprise uses to make optional connections. Direction Endpoint URL or Details Port Protocol Notes desktop machines to Enterprise Manager server Enterprise server User-specified Enterprise server 443 or userspecified HTTPS Communication is twoway HTTP traffic, initiated in-bound by the desktop machine. Enterprise Manager machine to HPE License activation server HPE Licensing Service HTTPS For one-time activation of the Enterprise server license as well as periodic checks during an update. You HPE Security Software (17.20) Page 32 of 44

33 Direction Endpoint URL or Details Port Protocol Notes may optionally use the following: An offline activation process instead of using this direct connection Upstream proxy with authentication instead of a direct Internet connection Enterprise Manager machine to mail server User s mail server alerts 25 or userspecified SMTP Used for SMTP alerts for administration team. To enable mobile TXT alerts, you can use an SMTP-to- SMS gateway address. Enterprise Manager machine to SNMP Community User s SNMP Community SNMP alerts 162 or userspecified SNMP Used for SNMP alerts for administration team. Connections for Tools The following table lists the ports and protocols that the tools use to make connections. Tool Direction Endpoint Port Protocol Notes Web Proxy To target web application localhost 8080 or user-specified HTTP or HTTPS Intercepts and displays web traffic Web Form Editor To target web application localhost Dynamic, 8100, or user-specified HTTP or HTTPS Intercepts web traffic and captures submitted forms Login or Workflow Macro Recorders To target web application localhost Dynamic, 8081, or user-specified HTTP or HTTPS Records browser sessions for replay during scan Web Discovery To targeted IP range localhost User-specified range HTTP and HTTPS Scanner for identifying rogue web applications hosted among the targeted scanned IP and port ranges Use to provide targets to (manually) Enterprise Sensor A Enterprise sensor is a sensor that runs scans on behalf of Enterprise. See " Requirements" on page 21 for more HPE Security Software (17.20) Page 33 of 44

34 information. To run a scan from Enterprise, you must have at least one instance of connected and configured as a sensor. Enterprise Notes and Limitations You can connect any instance of Software Security Center to only one instance of Enterprise, and you can connect any instance of Enterprise to only one instance of Software Security Center. For a Enterprise environment to support Internet Protocol version 6 (IPv6), you must deploy the IPv6 protocol on each Enterprise Administrative Console, each Enterprise sensor, and the Enterprise server. License Infrastructure Manager Requirements This section describes the hardware and software requirements for License Infrastructure Manager (LIM). Hardware Requirements HPE recommends that you install the LIM on a system that conforms to the supported components listed in following table. Beta or pre-release versions of operating systems, service packs, and required third-party components are not supported. Component Requirement Notes Processor 2.5 GHz single-core or faster Recommended 1.5 GHz single-core Minimum RAM 2+ GB Recommended 1 GB Minimum Hard disk 50+ GB Recommended 20 GB Minimum Display 1280 x 1024 Recommended 1024 x 768 Minimum HPE Security Software (17.20) Page 34 of 44

35 Software Requirements LIM runs on and works with the software packages listed in the following table. Package Versions Notes Windows Server Windows Server 2012 or 2012 R2 Windows Server 2008 R2 with SP1 Windows Server 2008 with SP2 Internet Information Services (IIS) Version 7 or later.net Framework Browser Internet Explorer 11 Recommended Mozilla Firefox 51.0 Recommended Mozilla Firefox 44.0 or 47.0 Version Compatibility Matrix This section provides compatibility information for Software components. Software Component Compatibility Software version works with the component versions listed in the following table. Component Versions Software Security Center Static Code Analyzer Tools (Audit Workbench, Secure Code Plugins, and Custom Rules Editor) Runtime Agent Enterprise HPE Security Software (17.20) Page 35 of 44

36 FPR File Compatibility Earlier versions of Software products cannot open and read FPR files generated by later versions of Software products. For example, Audit Workbench 4.40 cannot read FPR files. However, later versions of Software products can open and read FPR files generated by earlier versions of Software products. For example, Audit Workbench version can open and read version 4.40 FPR files. FPR version numbers are determined as follows: The FPR version is the same as the version of the analyzer that initially generated it. For example, an FPR generated by Software version also has the version number The FPR version is the same as the version of the Software Security Center or Static Code Analyzer Tool used to modify or audit the FPR. If you merge two FPRs, the resulting FPR has the version of the more recently generated FPR. For example, if you merge a version 4.40 FPR with a version FPR, the resulting FPR has the version number You can only open FPR files with Software Security Center or Static Code Analyzer Tools version or later. Caution Regarding Uploading FPRs to Software Security Center Software Security Center keeps a project file that contains the latest scan results and audit information for each application. Audit Workbench and the Secure Code Plugins also use this project file for collaborative auditing. Each time you upload an FPR to Software Security Center, it is merged with the existing project file. If the FPR has a later version number than the existing project file, the existing project file version changes to match the FPR. For Audit Workbench and the Secure Code Plugins to work with the updated FPR, they must be at least the same version as the FPR. For example, Audit Workbench 4.40 cannot open and read a FPR. Software Security Center Support for Runtime Configuration Bundle and Template Software Security Center supports Runtime Configuration Bundle and Template Virtual Machine Support You can run software products in an approved operating system in virtual machine environments. You must provide dedicated CPU and memory resources that meet the minimum hardware requirements. If you find issues that cannot be reproduced on the native environments with sufficient processing, memory, and disk resources, you need to work with the provider of the virtual environment to get them resolved. HPE Security Software (17.20) Page 36 of 44

37 Note: Running software products in a VM environment with shared CPU and memory resources is not supported. Technologies and Features no Longer Supported in this Release The following technologies and features are no longer supported in Software: JIRA 6.4 Mac OS X Mac OS X Apple LLVM (clang) compiler version 7.x Swift compiler version 2.2 Team Foundation Server 2012 Visual Studio 2012 Premium, Professional, and Ultimate Scanning plugin for Xcode IDE 7.x is only available on demand from HPE Security Support Technologies and Features to Lose Support in the Next Release Customers who are currently using Runtime are encouraged to upgrade to Application Defender, a Runtime Application Self Protection (RASP) solution that helps mitigate risk from homegrown or third-party applications. In the next release, you will no longer be able to manage Runtime from Software Security Center. In addition, all sales of the standalone Runtime product require pre-approval from Product Management. Application Defender provides visibility into application abuse while protecting software vulnerabilities from exploits in real time. Application Defender is available as a SAAS offering or it can be installed on-premises. For more information, see The following technologies and features are scheduled for deprecation in the next Software release: Apache Tomcat 8.0 ( Software Security Center) Remediation Extension for JDeveloper IBM DB2 IBM WebSphere ( Software Security Center) IntelliJ IDEA 15 (Secure Code Plugins) JIRA 7.1 Oracle Database 12c Release 1 ( Software Security Center) Oracle Linux 6 update 5 and later, Oracle Linux 7.x Oracle WebLogic ( Software Security Center) Swift compiler version ( Static Code Analyzer) HPE Security Software (17.20) Page 37 of 44

38 Acquiring Software Software is available as an electronic download. The following table lists the available packages and describes their contents. File Name HPE_Security 17.20_Windows.iso HPE_Security 17.20_ Windows.iso.sig HPE_Security 17.20_Linux_Unix_ Mac.iso HPE_Security 17.20_Linux_Unix_ Mac.iso.sig HPE_Security SSC_Server_ zip HPE_Security SSC_Server_ zip.sig HPE_Security CloudScan_ Controller_17.20.zip HPE_Security CloudScan_ Controller_17.20.zip.sig HPE_Security Runtime_17.12.zip HPE_Security Runtime_ zip.sig HPE_Security SCA_and_Apps_ 17.20_Windows.zip Description (For Windows operating systems) Disc image of the entire Software product line. After downloading, you must either mount the ISO image or burn it to a DVD before installation. (For Windows operating systems) Signature file for the Software product line ISO (For Linux, Unix, and Mac operating systems) Disc image of the entire Software product line. After downloading, you must either mount the ISO image or burn it to a DVD before installation. (For Linux, Unix, and Mac operating systems) Signature file for the Software product line ISO Software Security Center Signature file for Software Security Center CloudScan Controller Signature file for CloudScan Controller Runtime Signature file for Runtime SCA and Applications package for Windows This package includes the following components: Static Code Analyzer Audit Workbench Custom Rules Editor Process Designer Plugin for Eclipse HPE Security Software (17.20) Page 38 of 44

39 File Name Description Analysis Plugin for IntelliJ and Android Studio Package for Visual Studio Scan Wizard Sample applications Note: Security content (Rulepacks and external metadata) can be downloaded during the installation. Remediation Extension for JDeveloper, Remediation Plugin for Eclipse, Security Assistant Plugin for Eclipse, Remediation Plugin for IntelliJ and Android Studio, and Jenkins Plugin are included as part of the HPE_Security 17.20_ Windows disc image. HPE_Security SCA_and_Apps_ 17.20_Windows.zip.sig HPE_Security SCA_and_Apps_ 17.20_Mac.tar.gz Signature files for the SCA and Applications package for Windows SCA and Applications package for macos This package includes the following components: Static Code Analyzer Audit Workbench Custom Rules Editor Process Designer Plugin for Eclipse Analysis Plugin for IntelliJ and Android Studio Scan Wizard Sample applications Note: Security content (Rulepacks and external metadata) can be downloaded during the installation. Remediation Extension for JDeveloper, Remediation Plugin for Eclipse, Security Assistant Plugin for Eclipse, Remediation Plugin for IntelliJ and Android Studio, and Jenkins Plugin are included as part of the HPE_Security 17.20_ Linux_Unix_Mac disk image. HPE Security Software (17.20) Page 39 of 44

40 File Name HPE_Security SCA_and_Apps_ 17.20_Linux.tar.gz HPE_Security SCA_and_Apps_ 17.20_Linux.tar.gz.sig HPE_Security SCA_ 17.20_HPUX.tar.gz HPE_Security SCA_ 17.20_HPUX.tar.gz.sig HPE_Security SCA_ 17.20_Solaris.tar.gz HPE_Security SCA_ 17.20_Solaris.tar.gz.sig HPE_Security SCA_ 17.20_AIX.tar.gz HPE_Security SCA_ 17.20_AIX.tar.gz.sig HPE_Security Scan_Wizard_ 17.20_Windows.zip Description SCA and Applications package for Linux The package includes the following components: Static Code Analyzer Audit Workbench Custom Rules Editor Process Designer Plugin for Eclipse Analysis Plugin for IntelliJ and Android Studio Scan Wizard Sample applications Note: Security content (Rulepacks and external metadata) can be downloaded during the installation. Remediation Extension for JDeveloper, Remediation Plugin for Eclipse, Security Assistant Plugin for Eclipse, Remediation Plugin for IntelliJ and Android Studio, and Jenkins Plugin are included as part of the HPE_Security 17.20_ Linux_Unix_Mac disk image. Signature file for Static Code Analyzer for Linux Static Code Analyzer for HP-UX Signature file for Static Code Analyzer for HP-UX Static Code Analyzer for Solaris Signature file for Static Code Analyzer for Solaris Static Code Analyzer for AIX Signature file for Static Code Analyzer for AIX Scan Wizard for Windows HPE Security Software (17.20) Page 40 of 44

41 File Name HPE_Security Scan_Wizard_ 17.20_Windows.zip.sig HPE_Security Scan_Wizard_ 17.20_MacOSX.tar.gz HPE_Security Scan_Wizard_ 17.20_MacOSX.tar.gz.sig HPE_Security Scan_Wizard_ 17.20_Linux.tar.gz HPE_Security Scan_Wizard_ 17.20_Linux.tar.gz.sig _32_17.20.zip _64_17.20.zip _Agent_17.12.zip HPSecurityToolkit_17.20.zip WI_Enterprise_17.20.zip Description Signature file for Scan Wizard for Windows Scan Wizard for macos Signature file for Scan Wizard for macos Scan Wizard for Linux Signature file for Scan Wizard for Linux 32-bit version package This package includes product documentation (PDF) 64-bit version package This package includes product documentation (PDF) Agent package HPE Security Toolkit package for use with Enterprise Enterprise package The package includes the following components: Enterprise server Enterprise Administrative Console Product documentation (PDF) Downloading Software To download software: 1. Open a browser window and go to 2. Sign in with your HPE Passport credentials. 3. Click Manage Entitlements. 4. In the search bar, enter your Order Number, and then click Search. 5. Click Download Software. 6. Find the product name and version for the software you want to download, and then click Select. If you encounter any difficulties with the download process, click Contact Us / Self Help for more information. HPE Security Software (17.20) Page 41 of 44