Fortify

Question 1

Give the elevator pitch for Fortify.

Answer 1

Fortify is a suite of tightly integrated solutions for identifying, prioritising, and helping with the process of fixing security vulnerabilities in software.

Question 2

Give the elevator pitch for Fortify on Demand.

Answer 2

~ helps resolve software vulnerabilities using the only solution that fully integrates vulnerability analysis across the entire software lifecycle - from development to QA testing to deployed applications.
~ offers end-to-end application security, delivered as a service.

Question 3

What are the 3 key value props of FoD?

Answer 3

#1 Secure Development: Finding and fixing application security issues early, during development, is far less costly than waiting until after an app has been deployed, so empowering developers to create secure software from inception is critical.
#2 Security Testing: A dynamic or mobile assessment  of the running app in a QA, test, staging or production environment simulates the real-world hacking techniques and attacks employed by the bad guys.
#3 Production Monitoring: FoD provides all production application monitoring  activities in a single, integrated place.

Question 4

What are the personas to sell FoD to?

Answer 4

CISO, AppSec Manager, and QA

Question 5

What is the CISO’s role in the FoD buying process and what are they responsible for?

Answer 5

Buyer/decision maker/budget owner. Responsible for protecting business and brand through overall risk management.

Question 6

What is the AppSec Manager’s role in the FoD buying process and what are they responsible for?

Answer 6

Evaluator/project owner. Make sure all teams are aligned and manages AppSec program. Determines how to integrate in security testing and automate tool chains.

Question 7

What is the QA’s role in the FoD buying process and what are they responsible for?

Answer 7

Influencer. Application testing/user.

Question 8

What does the CISO care about reg. AppSec testing?

Answer 8

Securing intellectual property, sensitive data, and adhering to compliance.

Question 9

What does the AppSec Manager care about reg. AppSec testing?

Answer 9

Ensuring apps are secure before releasing into production.

Question 10

What does the QA care about reg. AppSec testing?

Answer 10

Tools ease of use and integration into the SDLC.

Question 11

What topics to discuss with the CISO reg. using FoD for AppSec testing?

Answer 11

Fortify’s time to value/ROI

Question 12

What topics to discuss with the AppSec Manager reg. using FoD for AppSec testing?

Answer 12

Testing speed, accuracy of results, line of code detail, remediation recommendations, ease of use, and integration capabilities.

Question 13

What topics to discuss with the QA reg. using FoD for AppSec testing?

Answer 13

Line of code detail, remediation recommendations, and integration into developers native environment while meeting release deadlines.