FAQs
User roles and permissions
This happens because FOD has the Global User Role policy. Hence, user roles cannot be assigned at application level for FOD. When a user is added to a FOD application via Console, the user inherits the global FOD role.
If a user is a Project Admin (PA) for any project with FOD applications, user is granted the GT_MANAGER role.
Users with the GT_MANAGER role will appear as Project Admin for the FOD apps they have access to.
Security scanning tools
Applications are counted based on the number of components.
Example: If your system has 2 components such as Internet and Intranet compartment, these are treated as 2 separate applications. This also applies similarly to systems with several components
Example: Mobile apps for 2 OS (Android, iOS), a website, WebAPI and Batchjob are treated as 5 separate applications.
We recommend assigning 1 Fortify application per microservice to track and manage findings. However, if you want to reduce the number of Fortify applications and does not need to manage insights for each microservice, you can use the same Fortify app for multiple microservices where the last scan of one microservice can be overridden by the scan of another microservice.
Yes, you can use WebInspect for DAST. Note this is applicable for Internet-facing applications only.
IM8 compliance
Yes, both IaC and SAST scanning are important, as they serve different functions in the security assessment process. IaC scanning focuses on configuration management codes, while SAST scanning targets the language and framework used in the application.
Although IaC scanning is not explicitly required by IM8, it is highly recommended as a best practice to reduce vulnerabilities in your cloud environment. However, SAST and DAST scanning are mandatory standards under IM8 compliance.
Yes, refer to DevSecOps playbook for best practices in terms of security testing.
It will partially fulfil the clause. WebInspect covers the VA component. The Agency would be required to engage Pentesters to perform penetration testing which is a manual effort. Refer to DevSecOps playbook for best practices in terms of security testing.
Single sign-on (SSO) and access
If the Single Sign-On (SSO) link for Fortify on Demand (FOD) is not available, you can access FOD directly by using the link https://sgp.fortify.com/Applications/AllReleases?rpp=100&sortdir=Asc.
