At Your Service: Veracode's SaaS-based application analysis - Information Security Magazine

At Your Service: Veracode's SaaS-based application analysis

SecurityReview

Veracode

www.veracode.com
Price: Minimum cost of engagement is at $40K

Application development has historically given short shrift to security, and we pay the price for

    Requires Free Membership to View

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

it every day as attackers exploit vulnerable Web apps to control corporate systems and steal sensitive data.

Companies are finally building security into the software development lifecycle, but vetting software for security is difficult, time-consuming and error-prone. Organizations often turn to pen testers and/or a variety of commercial products.

Symantec spinoff Veracode weighs in with an on-demand software-as-a-service (SaaS) that performs binary analysis of any application.

Customers upload apps to Vera-code, which reports possible flaws and recommends remediation.

Binary analysis offers particular advantages. Companies are often twitchy about sharing source code, and binary analysis may well find flaws that source code, Web crawling and manual analysis miss. Moreover, applications are typically not monolithic, single-source programs but are built on various pieces contributed by internal and external developers.

"Modern applications are assembled from a mixed code base," says Veracode CEO Matt Moynahan. "Binary analysis analyzes 100 percent of the code."

Moynahan says that binary analysis complements other methods, including source code analysis and human testing. Veracode partners with SPI Dynamics, maker of the WebInspect app scanner.

"All applications are not equal," he says. "If you have a flight control system for a Boeing 747, for example, you want to test with a variety of methods."

This was first published in July 2007