Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 9 down vote favorite
1

I would like to hear from you which tools (commercial and open source) do you use to share results during collaborative penetration test or source code/binary analysis. Well-known Dradis framework helps at some level, but it would be nice to see other possible solutions, methodologies how teams work and exchange their results effectively.

share|improve this question

2 Answers

up vote 2 down vote

HP AMP and HP Fortify 360. HoneyApps Conduit. Denim Group Vulnerability Manager, Veracode, Aspect Security ARMS.

Atlassian Crucible, Friendpaste, SyntaxHighlighter, Smartbear Software CodeCollaborator

share|improve this answer
Good list, but except of that, it would be nice to hear something from personal experience - your opinion, maybe slight comparison, etc. (This note refers also to all others who would like to reply.) – anonymous Nov 20 '10 at 11:23
A lot of these are automated tools to find issues, but add very little in the way of sharing the results. – AviD♦ Nov 21 '10 at 12:52
@AviD: No, absolutely not. All of the tools I mentioned are for sharing the results. Perhaps I should mention that Veracode's offering is a risk management portal to submit appsec issues to, for sharing purposes, as a result of external pen-testes, code reviews, or their own Veracode services. – atdre Nov 22 '10 at 0:52
As far as i used HP Fortify, it is not a penetration testing tools rather it is a code scanner. The HP Fortify 360 is an administration control to report analyze every discovered vulnerability and to report false positives etc... I wouldn't call it sharing. I mean of course others can see the results and work on them but there is no mean to interact with chatting, or collaboration rooms etc... That's my 2 cent's – Phoenician-Eagle Mar 31 '11 at 19:12
up vote 2 down vote

With my current client I am using HP Fortify 360 as the central repository for sharing results to multiple teams in Development, Security Audit and Project Management.

All the development project build scripts can automatically upload results into 360, where a per project template is applied, the team can review issues and apply outcomes.

All issues are tracked over time - so their defect management system can effectivelydisplay results to management.

The reporting functionality includes technical detail on issues and recommendations for the development team, as well as high level stats for senior management.

Same as every tool, it has issues, however the management framework is pretty good, and for that reason it gets a thumbs up from me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.