Integrate IBM Rational Application Developer and IBM Security AppScan Source Edition

Transcription

1 Integrate IBM Rational Application Developer and IBM Security AppScan Source Edition Security testing for the Rational Application Developer application G Kiran Kumar Singh & Arnab Roy July 19, 2012 Page 1 of 21

2 INTRODUCTION...3 INSIGHT ON RATIONAL APPLICATION DEVELOPER...4 INSTALLATION OF RATIONAL APPLICATION DEVELOPER...4 INSIGHT ON SECURITY APPSCAN SOURCE...5 INSTALLATION OF SECURITY APPSCAN SOURCE...5 SETUP INTEGRATION BETWEEN RAD AND APPSCAN SOURCE...6 WORKING WITH THE INTEGRATION...14 METHOD 1: USING THE RAD WORKBENCH...14 METHOD 2: USING THE APPSCAN WORKBENCH...16 CONCLUSION...19 REFERENCES...20 Page 2 of 21

3 Introduction This white paper focuses on the integration of IBM Rational Application Developer (RAD) and IBM Security AppScan Source Edition with Developer plug-in. This integration helps security analysts and code developers to streamline the process of security testing. Imagine a time when you had to wait for the security analysts to do the security testing on the code and then wait for an approval or changes in case of vulnerabilities to move forward. This results in time delays. Thankfully, the RAD and Security AppScan integration cuts this time delay immensely as you can perform security testing with code development. Concisely, while you code or make a web application in Rational Application Developer, you can simultaneously test for security vulnerabilities within the code using Security AppScan Source with Developer plug-in. This process assists you with following proper remediation method (as suggested by AppScan Source) to change/modify code and mitigate security vulnerabilities when developing the web application. Page 3 of 21

4 Insight on Rational Application Developer Rational Application Developer provides you with smart tools to promote best practices, productivity, innovation, and agility in software development. This awardwinning integrated development environment enables you to quickly build, test, analyze, and publish Java EE 6, Web 2.0, and Service Oriented Architecture (SOA) applications on the latest versions of WebSphere Application Server and WebSphere Portal Server. Rational Application Developer is based on the open source Eclipse development platform. The Eclipse platform is an extensible development platform and application framework for building software. You can add plug-ins to the platform to include new functionality. The Eclipse platform comes with a Java Integrated Development Environment (IDE) for Java application development. It provides some common tools and features for Java developers. Built on top of the Eclipse platform, Application Developer adds a great number of capabilities including J2EE development, XML, web service development, database development. Installation of Rational Application Developer 1. Download Rational Application Developer from Passport Advantage: 2. Follow the installation instructions in the RAD Information Center: 3. Get a valid license from the License Key Center: Page 4 of 21

5 Insight on Security AppScan Source Security AppScan Source is a static analysis security testing (SAST) solution that enables you to identify source code vulnerabilities, review data and call flows, and identify threat exposure for each of your applications. Deployed throughout the software development lifecycle, Security AppScan Source software makes it easier for you to understand your threat exposure for audit and compliance purposes. Security AppScan Source software also helps facilitate a partnership between development and security teams by providing both groups with the information when needed. Developer plug-in integrates many Security AppScan Source features into Microsoft Visual Studio, the Eclipse workbench, and Rational Application Developer. This allows you to find and take action on vulnerabilities during the development process. The plug-in allows you to scan source code for security vulnerabilities and quality risks. It also lets you create quality rule configuration files that enable quality scanning in the Security AppScan Source command line interface and Security AppScan Source Edition for Automation. Installation of Security AppScan Source 1. Download Security AppScan Source with Developer plug-in from Passport Advantage: 2. Follow the installation instructions in this technote: 3. Get a valid license from the License Key Center: Page 5 of 21

6 Setup integration between RAD and AppScan Source Eclipse V3.5, V3.6, and V3.7 include a feature that allows you to install new software. You can use the feature to update your installation or browse to plug-ins to be added to your installation. These instructions guide you through the installation of the Security AppScan Source Developer Plug-in for Eclipse V3.5, V3.6, and V3.7 and Rational Application Developer V , V8.0, V8.0.1, V8.0.2, and V Select Help > Install New Software from the main workbench menu bar. Figure 1: Install New Software menu option in RAD Page 6 of 21

7 2. On the Available Software page, click Add. Figure 2: Available Software window in RAD Page 7 of 21

8 3. In the Add Site dialog box, specify a name for the update site in the Name field and then click Local. Figure 3: Window to Add Repository 4. In the Browse for Folder dialog box, navigate to the AppScan Source installation directory. For example, on Microsoft Windows XP navigate to the default installation directory, C:\Program Files\IBM\AppScan Source. Click OK to return to Add Site and then click OK to add the update site. Figure 4: Showing the path where AppScan Source Plug-in is located to be added Page 8 of 21

9 Figure 5: Showing addition of AppScan Source Plug-in Location 5. The new site is in the list. Complete the next steps according to your installation scenario: Applying the plug-ins after a full product installation Select the check box next to the Security AppScan Source Edition Developer Plug-in local site to ensure the selection of all required components. The application of the Security AppScan Source Edition for Developer plug-in for Eclipse depends on the application of some IBM Rational and Eclipse tools. For example, the Graphical Editing Framework (GEF). For your convenience, you can select these for installation when updating your development environment. You should select these for installation if they are not already applied to your development environment Security AppScan Source Edition for Developer plug-in requires the version listed in the updater or any higher version. The tools listed in the updater are required. However, their translations are optional. Page 9 of 21

10 Notes: If your workbench already has GEF applied, you likely do not need to reapply it. If you attempt reapplication, Eclipse might automatically modify the installation request to remove the GEF feature, or the installation request might fail. If the request fails due to GEF dependencies, try to install the Security AppScan Source Developer plug-ins without selecting the GEF feature. If you install the GEF component with the Security AppScan Source Developer Plug-in installation, and then want to install an updated version of it from another update site, uninstall the existing GEF before installing the updated version. Applying the plug-ins after a fix pack installation The AppScan Source Edition Developer Plug-in local site should include a client feature for the fix pack version you apply. For example, if you require the application of the V8.5.1 fix pack, the local site should include AppScan Source Edition Eclipse Client Feature, V If this feature is not present, it might be necessary to refresh or re-create the local site. Page 10 of 21

11 6. Click Next to proceed to the next install panel. Figure 6: Showing that AppScan Source Developer being selected to be installed Page 11 of 21

12 7. On the Install Details page, review the items to install. Click Next. Figure 7 : Showing the entire available plug in components available to be installed Page 12 of 21

13 8. On the Review Licenses page, accept the license agreement. Click Finish. Figure 8: Showing End User License Agreement Page 13 of 21

14 Working with the integration There are two ways to work with integration of RAD and Security AppScan Source. Method 1: Using the RAD Workbench There is a new menu option named AppScan Source Edition after the successful installation of the Security AppScan Source plug-in. You can run a scan accordingly. For example, in Figure 9 you run the scan on a specific project. Once the scan is complete, AppScan Source Perspective prompts to view the results. Figure 9: The Scan Project option in RAD Page 14 of 21

15 Figure 10: The option to switch perspective in RAD Figure 11: Scan Project Output Page 15 of 21

16 Method 2: Using the AppScan Workbench The menu option File > Add Application > Existing Eclipse, RAD or WSAD Workspace helps to get the workspace into Security AppScan Source. Figure 12: Showing the import menu option in Security AppScan Source Figure 13: Showing RAD Workspace being added to Security AppScan Source Page 16 of 21

17 Once you add the workspace, run the scan according to the requirement. You will see corresponding assessment results. Figure 14: Scan Project option in AppScan Figure 15: Showing completion of the scan and option to display results in AppScan Page 17 of 21

18 Figure 16: Assessment Results Page 18 of 21

19 Conclusion Here are some benefits which this integration provides: Cost-effective risk management from early identification of vulnerabilities. Security AppScan Source is armed with advice from the industry s most comprehensive software security knowledge base with links to the Common Weakness Enumeration (CWE) community site. The knowledge base helps ensure the precise identification of vulnerabilities. With a few clicks, identify a confirmed vulnerability, add notes, and assign with your defect tracking system. Reliably manage and measure risk across your portfolio of applications. Reporting templates provide specific information to prove compliance with leading standards and regulations such as the OWASP Top 10 and the PCI Data Security Standard. Seamlessly works with your IDE of choice, including Rational Application Developer, Eclipse, and Microsoft Visual Studio Make enterprise-wide implementations practical and efficient with centralized push-and-play deployment. The remediation advice as seen in the scan results of Security AppScan Source scan helps development organizations learn about the vulnerability and fix it. Building security into application development can help your business reduce risk, enhance compliance, protect brand reputation, gain flexibility, and reduce long-term security costs. Leveraging its broad and deep security experience and offerings, IBM can provide a comprehensive strategy to help your business effectively manage web application security. Page 19 of 21

20 References FAQ: How do I install new plug-ins? Page 20 of 21

21 Copyrights, trademarks, and disclaimers IBM, the IBM logo, ibm.com, WebSphere, and Rational are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. THE INFORMATION CONTAINED IN THIS DOCUMENT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY. WHILE EFFORTS WERE MADE TO VERIFY THE COMPLETENESS AND ACCURACY OF THE INFORMATION CONTAINED IN THIS DOCUMENT, IT IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN ADDITION, THIS INFORMATION IS BASED ON IBM S CURRENT PRODUCT PLANS AND STRATEGY, WHICH ARE SUBJECT TO CHANGE BY IBM WITHOUT NOTICE. IBM SHALL NOT BE RESPONSIBLE FOR ANY DAMAGES ARISING OUT OF THE USE OF, OR OTHERWISE RELATED TO, THIS DOCUMENT OR ANY OTHER DOCUMENTATION. NOTHING CONTAINED IN THIS DOCUMENT IS INTENDED TO, NOR SHALL HAVE THE EFFECT OF, CREATING ANY WARRANTIES OR REDOCUMENTS FROM IBM (OR ITS SUPPLIERS OR LICENSORS), OR ALTERING THE TERMS AND CONDITIONS OF ANY AGREEMENT OR LICENSE GOVERNING THE USE OF IBM PRODUCTS OR SOFTWARE. Copyright International Business Machines Corporation All rights reserved. Page 21 of 21