IBM Rational AppScan automates Web application security testing to identify and help remediate application vulnerabilities

Transcription

1 IBM United States Announcement , dated October 16, 2007 IBM Rational AppScan automates Web application security testing to identify and help remediate application vulnerabilities Description...2 Offering Information...3 Publications... 3 Technical information...4 Software Services...5 Ordering information...5 Terms and conditions... 7 Prices...9 Order now...9 At a glance Watchfire AppScan is renamed to IBM Rational AppScan. The AppScan products provide: Automated Web application scanning and testing for all common Web application vulnerabilities including Web Application Security Consortium threat classification such as SQL-Injection, Cross-Site Scripting, and Buffer Overflow and intelligent fix recommendations to ease remediation Broad application coverage including integrated Web services scanning, Java -Script execution (including AJAX) and parsing Advanced remediation capabilities including a comprehensive task list necessary to fix issues uncovered during the scan Over 40 out-of-the box security compliance reports including PCI Data Security Standard, ISO 17799, and ISO 27001, HIPAA, GLBA, and Basel II For ordering, contact: Your IBM representative or the Americas Call Centers at 800-IBM-CALL Reference: YE001 Overview With this announcement, Watchfire AppScan is renamed to IBM Rational AppScan. A leading Web application security scanning and testing solution used to automate application audits, AppScan offers a solution for all types of security testing, outsourced or in-house and for all types of users: Application developers Quality assurance (QA) Penetration testers Security auditors Senior management AppScan's scan engine continuously and automatically audits Web applications, tests for security and compliance issues, and generates actionable reports with fix recommendations to simplify the remediation process across the software development process. Key prerequisites Refer to the Hardware requirements and Software requirements IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 1

2 sections. Planned availability dates October 16, 2007 (electronic software delivery) October 31, 2007 (media and documentation) Description IBM Rational AppScan helps ensure the security and compliance of Web applications throughout the software development lifecycle. It is designed for the broadest range of users from non-security professionals to advanced power users who can utilize the added tools and extensions to create a customized scanning environment. AppScan software features new offerings to improve your ability to effectively scan Web applications and test for security issues. Features of AppScan Standard Edition include: Fast and comprehensive scan engine. Configuration wizard to assist in scan setup. User interface that includes an application tree, view selector, hierarchical security issues results list, remediation view and details pane. Adaptive test process that intelligently mimics human logic to adapt the testing phase to each application. Developer essentials test policy that automates security testing of the most critical issues in a format that can optimize and simplify the process for development. Concurrent scanning that lets you simultaneously run multiple instances of AppScan. Complex authentication support that enables multi-step authentication procedures in Web applications. Supported authentication methods include Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA), stepped authentication, multifactor authentication, one-time passwords, Universal Serial Bus (USB) keys, smartcards, and mutual authentication. Advanced session management that actively checks that you remain logged in, and automatically refreshes your login when required. Pattern search rules that look for strings and regular expressions in the original responses. This facilitates, for example, security testing around credit card or social security sequence. Integrated Web services scanning that understands application-to-application interactions and comes with a wide range of advanced Simple Object. Access Protocol (SOAP) tests, resulting in broad coverage of the scanned application. Real-time view of results that lets you start examining and acting on the issues that have been found before the scan is completed which is useful for large scans and for auditors or penetration testers with limited time for application testing. Enhanced view of issues, which provides greater control over the way issues are displayed. You can increase and decrease the request/response font, choose between two viewing modes word wrap and regular view perform searches and print the information pages presented by AppScan. AppScan Tester Edition supports these same features and also provides: Seamless integration of security tests into the existing QA environment to enable security tests alongside functional and performance testing QA security testing results that produce details required to report and remediate problems, including Request/Response information, Fix Recommendations and Advisories associated with each issue AppScan also includes the capability through the AppScan extensions Framework (AXF) to enable boundless customization and extensibility of the solution. AXF is a flexible framework that lets users load or even create add-ons to extend AppScan's functionality. Coupled with Pyscan, a new AppScan Python-Scripting-based Web application security testing platform, IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 2

3 security professionals can extend and create their own custom testing solutions that use the core technology of AppScan to accomplish specific and individual security-related tasks. Examples of available extensions include: QA Defect Logger Export security defects directly into IBM Rational Clear Quest for issue-tracking systems including WordReporter Customize an AppScan report for Microsoft Word; Mail-E-Vent Receive notifications when certain AppScan events occur during the scan; HTTPScout Use NMAP to locate open HTTP or HTTPS ports on the scanned Web server, adding them to the current scan configuration; DirectoryList-To-EXD Import a list of any files from the Web server including Web pages, included files and others into AppScan to improve coverage (created by Dennis Rand, Jyske Bank A/S); QuickSearch extension Search issue types with a right click, covering online databases like Google, SecurityFocus and others (created by Oliver Ng, Deloitte, and Touche LLP) IPLA and Subscription and Support considerations IPLA licenses can be transferred from one machine to another within, but not limited to an enterprise. You may aggregate the capacity for all the processors the product is operated on to achieve a more economic price. This will result in a single Proof of Entitlement (PoE). It is your responsibility to manage the distribution of Value Units within the limits of the entitlement of the product license. Subscription and Support must cover the same capacity as the product license entitlement. Subscription and Support will be available in the country in which the agreement is made. Trademarks Rational and Cross-Site are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Microsoft is a trademark of Microsoft Corporation. Java is a trademark of Sun Microsystems, Inc. Other company, product, and service names may be trademarks or service marks of others. Offering Information Product information is available via the Offering Information Web site Also, visit the Passport Advantage Web site Publications No publications are shipped with these products. The IBM Publications Center The Publications Center is a worldwide central repository for IBM product publications and marketing material with a catalog of 70,000 items. Extensive search facilities are provided. Payment options for orders are via credit card (in the U.S.) or customer number for 20 countries. A large number of publications are available online in various file formats, and they can all be downloaded by all countries. IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 3

4 Technical information Hardware requirements: IBM Rational AppScan Intel Pentium 4, 1 GB of RAM, 10 GB free space IBM Rational AppScan Tester 3 GHz Intel Pentium 4 2 GB RAM 200 MB available hard-drive space for application 10 GB available hard-drive space for scan logs on agent server 200 GB available hard drive for system hosting the database Software requirements: IBM Rational AppScan Operating System: Windows 2000/2003, Windows XP, or Windows Vista Must also download.net framework 2.0 IE 6.0, or higher IBM Rational AppScan Tester Windows Server 2003 SP1, or later SQL Server 2005 SP1 Standard Edition, or higher IIS 5.1, or higher.net framework 2.0 IE 6.0 SP1, or higher Planning information Customer responsibilities: Software Maintenance is included with licenses purchased through Passport Advantage and Passport Advantage Express. Product upgrades and technical support are provided by the Software Maintenance offering as described in the Agreements. Product upgrades provide the latest versions and releases to entitled software and technical support provides voice and electronic access to IBM support organizations, worldwide. IBM includes one year of Software Maintenance with each program license acquired. The initial period of Software Maintenance can be extended by the purchase of a renewal option, if available. Packaging: IBM Rational AppScan Standard Edition IBM Rational AppScan Standard Edition CD IBM Rational AppScan Standard Edition Quick Start Guide License Key Notification IBM Rational AppScan Tester Edition IBM Rational AppScan Tester Edition CD IBM Rational AppScan Tester Edition Quick Start Guide License Key Notification Security, auditability, and control The customer is responsible for evaluation, selection, and implementation of security features, IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 4

5 administrative procedures, and appropriate controls in application systems and communication facilities. Software Services IBM Software Services has the breadth, depth, and reach to manage your services needs. You can leverage the deep technical skills of our lab-based, software services team and the business consulting, project management, and infrastructure expertise of our IBM Global Services team. Also, we extend our IBM Software Services reach through IBM Business Partners to provide an unmatched portfolio of capabilities. Together, we provide the global reach, intellectual capital, industry insight, and technology leadership to support any critical business need. To learn more about IBM Software Services or to contact a Software Services sales specialist, visit To locate an IBM Business Partner, visit Ordering information This product is only available via Passport Advantage. It is not available as shrinkwrap. Product information Product Licensed function title Product group category IBM Rational AppScan Standard Ed Software Software Quality Quality IBM Rational AppScan Tester Software Software Edition Quality Quality PID Charge unit Program name number description IBM Rational AppScan Standard Ed 5724-T59 Floating user IBM Rational AppScan Standard Ed 5724-T59 Floating user IBM Rational AppScan Tester Edition 5724-T51 Server IBM Rational AppScan Tester Edition 5724-T51 Server IBM Rational AppScan Tester Edition 5724-T51 Authorized user IBM Rational AppScan Tester Edition 5724-T51 Authorized user Charge metrics definitions Server A server is a computer system that executes requested procedures, commands, or applications to one or more user and/or client devices. A PoE must be obtained for each server regardless of the number of processors and partitions in the server on which the program runs or for each server managed by the program. Where blade technology is employed, each blade is considered a separate server. Authorized user An authorized user is one and only one individual (named or unnamed) within or outside your enterprise. A PoE must be obtained for each individual user accessing the program in any manner. A program licensed under an authorized user PoE may be installed on a single computer or server, and accessed by multiple users, provided that a PoE has been obtained for each individual user accessing the program either directly or indirectly (via a multiplexing program, device, or application server) through any means on behalf of the user. Floating user You may utilize the program, including installation of the program on multiple servers, provided that use of the program occurs via a license server, and the total number of concurrent users IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 5

6 does not exceed the total number of floating user licenses obtained for the program. Passport Advantage program licenses IBM Rational AppScan Standard Edition Part description IBM Rational AppScan Standard Ed Ratl AppScan Standard Edition Floating User ANNUAL SW MAINT RNWL Ratl AppScan Standard Edition Floating User LIC+SW MAINT 12 MO Ratl AppScan Standard Edition Floating User SW MAINT REINSTATE 12 MO Ratl AppScan Std Ed for Sytem z Floating User ANNUAL SW MAINT RNWL Ratl AppScan Std Ed for Sytem z Floating User LIC+SW MAINT 12 MO Ratl AppScan Std Ed for Sytem z Floating User SW MAINT REINSTATE 12 MO IBM Rational AppScan Tester Edition Part description IBM Rational AppScan Tester Edition Ratl AppScan Tester Ed for System z Authorized Usr ANNUAL SW MAINT RNWL Ratl AppScan Tester Ed for System z Authorized Usr LIC+SW MAINT 12 MO Ratl AppScan Tester Ed for System z Authorized Usr SW MAINT REINSTATE 12 MO Authorized User ANNUAL SW MAINT RNWL Authorized User LIC+SW MAINT 12 MO Authorized User SW MAINT REINSTATE 12 MO Server ANNUAL SW MAINT RNWL Server LIC+SW MAINT 12 MO Server SW MAINT REINSTATE 12 MO for System z Server ANNUAL SW MAINT RNWL for System z Server LIC+SW MAINT 12 MO for System z Server SW MAINT REINSTATE 12 MO Passport Advantage supply Program name/description Rational AppScan Std Ed V7.6.1 Ratl AppScan Standard Edition, V7.6.1, Windows, English Media Pack Part number E046DLL D61SYLL D61SZLL E046ELL D61T0LL D61T1LL Part number E046BLL D61SULL D61SVLL E046ALL D61SSLL D61STLL E046FLL D61T2LL D61T3LL E046CLL D61SWLL D61SXLL Part number BT000EN IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 6

7 Rational AppScan Tester Ed V7.6.1, V7.6.1, Windows, English Media Pack BT001EN Passport Advantage customer: Media pack entitlement details Customers with active maintenance or subscription for the products listed are entitled to receive the corresponding media pack. Rational AppScan Tester Ed V7.6.1 Entitled maintenance Part offerings description Media packs description number Ratl AppScan Tester Ratl AppScan Tester BT001EN Edition Authorized User Edition, V7.6.1, Windows, User Ratl AppScan Tester Ratl AppScan Tester BT001EN Edition Authorized User Edition, V7.6.1, Windows, for System Z Ratl AppScan Tester Ratl AppScan Tester BT001EN Edition Server Edition, V7.6.1, Windows, Ratl AppScan Tester Ratl AppScan Tester BT001EN Edition Server for Edition, V7.6.1, Windows, System Z Rational AppScan Std Ed V7.6.1 Entitled maintenance Part offerings description Media packs description number Ratl AppScan Standard Ratl AppScan Standard BT000EN Edition Floating User Edition, V7.6.1, Windows, Ratl AppScan Standard Ratl AppScan Standard BT000EN Edition Floating User for Edition, V7.6.1, Windows, System Z Terms and conditions The information provided in this announcement letter is for reference and convenience purposes only. The terms and conditions that govern any transaction with IBM are contained in the applicable contract documents such as the IBM International Program License Agreement, IBM International Passport Advantage Agreement, and the IBM Agreement for Acquisition of Software Maintenance. Licensing: IBM International Program License Agreement including the License Information document and Proof of Entitlement (PoE) govern your use of the Program. PoEs are required for all authorized use. Part number products only, offered outside of Passport Advantage, where applicable, are license only and do not include Software Maintenance. This software license includes Software Maintenance, previously referred to as Software Subscription and Technical Support. License Information form number Program Program name number Form number IBM Rational AppScan Standard Edition 5724-T59 L-KHUY-772G55 IBM Rational AppScan Tester Edition 5724-T51 L-KHUY-772G55 The program's License Information will be available for review on the IBM Software License Agreement Web site Limited warranty: Yes IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 7

8 Warranty: IBM warrants that when the Program is used in the specified operating environment, it will conform to its specifications. The warranty applies only to the unmodified portion of the Program. IBM does not warrant uninterrupted or error-free operation of the Program or that IBM will correct all Program defects. You are responsible for the results obtained from the use of the Program. IBM provides you with access to IBM databases containing information on known Program defects, defect corrections, restrictions, and bypasses at no additional charge. Consult the IBM Software Support Guide for further information at IBM will maintain this information for at least one year after the original licensee acquires the program (warranty period). Program technical support: Technical support of a program product will be available for a minimum of three years from the general availability date, as long as your Software Maintenance is in effect. This technical support allows you to obtain assistance (via telephone or electronic means) from IBM for product-specific, task-oriented questions regarding the installation and operation of the program product. Software Maintenance also provides you with access to updates, releases, and versions of the program. You will be notified, via announcement letter, of discontinuance of support with 12 months' notice. If you require additional technical support from IBM, including an extension of support beyond the discontinuance date, contact your IBM representative or IBM Business Partner. This extension may be available for a fee. Money-back guarantee: If for any reason you are dissatisfied with the program and you are the original licensee, you may obtain a refund of the amount you paid for it, if within 30 days of your invoice date you return the program and its PoE to the party from whom you obtained it. If you downloaded the program, you may contact the party from whom you acquired it for instructions on how to obtain the refund. For programs acquired under the IBM International Passport Advantage Agreement, this term applies only to your first acquisition of the program. Authorization for use on home/portable computer: The program may be stored on the primary machine and another machine, provided that the program is not in active use on both machines at the same time. You may not copy and use this program on another computer without paying additional license fees. Product name IBM Rational AppScan Standard Edition IBM Rational AppScan Tester Edition Yes Yes Passport Advantage applies: Yes, and through the Passport Advantage Web site at This product is only available via Passport Advantage. It is not available as shrinkwrap. Agreement for acquisition of Software Maintenance: The following agreement applies for maintenance and does not require Customer signatures: IBM Agreement for Acquisition of Software Maintenance (Z ) Software maintenance applies: Yes. Software Maintenance is included with licenses purchased through Passport Advantage and Passport Advantage Express. Product upgrades and technical support are provided by the Software Maintenance offering as described in the Agreements. Product upgrades provide the latest versions and releases to entitled software and Technical Support provides voice and electronic access to IBM support organizations, worldwide. IBM includes one year of Software Maintenance with each program license acquired. The initial period of Software Maintenance can be extended by the purchase of a renewal option, if available. While your Software Maintenance is in effect, IBM provides you assistance for your routine, short duration installation and usage (how-to) questions, and code-related questions. IBM provides assistance via telephone and, if available, electronic access, to your information systems (IS) IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 8

9 technical support personnel during the normal business hours (published prime shift hours) of your IBM support center. (This assistance is not available to your end users.) IBM provides Severity 1 assistance 24 hours a day, 7 days a week. For additional details, consult your IBM Software Support Guide at Software Maintenance does not include assistance for the design and development of applications, your use of programs in other than their specified operating environment, or failures caused by products for which IBM is not responsible under the applicable agreements. For additional information about the International Passport Advantage Agreement and the IBM International Passport Advantage Express Agreement, visit the Passport Advantage Web site at Other terms Volume orders (IVO): No System i Software Maintenance applies: No Educational allowance available: Not applicable Prices Passport Advantage For Passport Advantage information and charges, contact your IBM representative or authorized IBM Business Partner. Additional information is also available at Business Partner information If you are an IBM Business Partner Distributor for Workstation Software acquiring products from IBM, you may link to Passport Advantage Online for resellers where you can obtain Business Partner pricing information. An IBM ID and password are required. obuy/passportadvantage/paoreseller Order now To order, contact the Americas Call Centers or your local IBM representative. To identify your local IBM representative, call 800-IBM-4YOU ( ). Phone: 800-IBM-CALL ( ) Fax: 800-2IBM-FAX ( ) Internet: callserv@ca.ibm.com Mail: IBM Teleweb Customer Support ibm.com Sales Execution Center, Americas North 3500 Steeles Ave. East, Tower 3/4 Markham, Ontario Canada L3R 2Z1 Reference: YE001 The Americas Call Centers, our national direct marketing organization, can add your name to the mailing list for catalogs of IBM products. Note: Shipments will begin after the planned availability date. IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 9

10 Trademarks System z and System i are trademarks of International Business Machines Corporation in the United States or other countries or both. Passport Advantage, Rational, SP1, and PartnerWorld are registered trademarks of International Business Machines Corporation in the United States or other countries or both. Intel and Pentium are registered trademarks of Intel Corporation. Windows is a trademark of Microsoft Corporation. Other company, product, and service names may be trademarks or service marks of others. This announcement is provided for your information only. For additional information, contact your IBM representative, call 800-IBM-4YOU, or visit the IBM home page at: IBM United States Announcement IBM is a registered trademark of International Business Machines Corporation 10