• State Not Answered
  • Replies replies
    2
  • Subscribers subscribers
    20
  • Views views
    266
  • Users 0 members are here

Fortify and native source code analysis of Android and iOS applications.

Carlos Carmo

Hello,

I have some questions regarding scanning the native source code for IOS and Android.

Can someone help me?

- Is it market practice to inspect (SAST) the NATIVE source code of Android and iOS Apps directly in the CI/CD process?

a) What is the security policy applied in the Fortify tool?
- Is the use of translation mandatory?
- Is it necessary to use all analyzers?
- Is it necessary to use all the rules in the Rulepacks?

b) Is there a set of specific good practices that should be followed?
- Settings to find more problems
- Settings to improve scanning performance (important)

- If it is not a good practice to perform inspection (SAST) on the NATIVE code of Mobile Apps, what is the best practice to follow using tools from the Fortify suite?

There are Scancentral SAST commands to improve the performance of these checks in iOS and Android source code.

Resources

Support
Documentation
Learning Services
Partner Programs
Privacy
Compliance
Help
Company
Privacy Policy
Terms of Use
Cookies Preferences
Accessibility
Anti-Slavery Statement
Support
Contact Us
Careers
Code of Business Conduct and Ethics
The opinions expressed above are the personal opinions of the authors, not of OpenText. By using this site, you accept the Terms of Use. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.), Hewlett Packard Enterprise Company, or Micro Focus. As of January 31, 2023, the Material is now offered by OpenText, a separately owned and operated company. Any reference to the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks is historical in nature and the HP, Hewlett Packard Enterprise/HPE, and Micro Focus marks are the property of their respective owners.