SMMJ.docx

Sole Make and Model Justification IBM Security AppScan Enterprise

PR: 1300503442

BACKGROUND/REQUIREMENT:

All Information Assurance (IA) and IA-enabled Information Technology (IT) Naval Undersea Warfare Center Division, Newport (NUWCDIVNPT) DoD information product systems, must be configured in accordance with DoD approved DISA security guidelines “Application Security and Development, Security Technical Implementation Guide” (STIG) and IA requirements. In accordance with NAVSEA Operational Designated Approving Authority (ODAA) Business Rules for obtaining an Authority to Operate (ATO) all application source code must be validated to identify any security flaws as part of IA compliance.

In order to comply with DISA STIG #5080 and STIG #5100 there is an immediate need to purchase automated tools. Specifically, to comply with DISA STIG #5080 automated code review tools are to be used whenever reviewing application source code. To comply with DISA STIG #5100, use of automated scanning tools accompanied with manual testing/validation which confirms or expands on the automated test results is an accepted best practice when performing application security testing. The tool is to provide automated fuzz testing capabilities for the testing of web applications including the identification of a wide range of application vulnerabilities including, but not limited to; buffer overflows, cross-site scripting flaws, denial of service format bugs and Structured Query Language (SQL) injection, all of which can lead to a successful compromise of the system or result in a denial of service.

MINIMUM REQUIREMENTS:

· Perform automated website scanning.

· Perform automated Visual Studio .NET source code scanning.

· Integration with Microsoft Visual Studio .NET

· Reduce the time to perform DISA STIG / IA source code review.

· Compatibility with NUWCDIVNPT existing infrastructure; no need to purchase additional hardware.

FLOATING USER SINGLE INSTALL

LICENSE + SW SUBSCRIPTION & SUPPORT 12 MONTHS

SW SUBSCRIPTION & SUPPORT 12 MONTHS

SW SUBSCRIPTION & SUPPORT 12 MONTHS

SUBSCRIPTION & SUPPORT 12 MONTHS

SOLE MAKE/MODEL JUSTIFICATION

IBM Security AppScan Enterprise is a standalone application and is fully integrated into the Microsoft Visual Studio .NET IDE. This gives Visual Studio .NET developers the ability to scan code for compliance on the fly. The website scanning gives the ability to perform automated fuzz testing which is a very long process if performed manually. There are other Commercial-Off-The-Shelf (COTS) code scanners on the market; however, the IBM Security AppScan Enterprise provides all the necessary features to accomplish our requirement needs for DISA STIG and IA compliance as well as being the most cost effective. IBM Security AppScan Enterprise is currently DADMS approved with ID# 87350 and meets the 508 compliance.

The following are the products comparison suggested by DISA STIG that can perform the automated scanning:

Product Comparison Matrix:

SALIENT CHARACTERISTIC CHART OF MANUACTURER

* Unlimited project source code scanning:

(1) IBM: Unlimited.

(2) HP: Limited based by pricing (see Cost **).

** Cost: Approx. price quoted by quantity and type of license.

(1) IBM: Unlimited project source code scanning. 1 floating license unlimited users for developer and 1 floating license for web scanning.

(2) HP: Limited to 30 projects source code scanning. Licensing: 5 registered developer users, 1 registered user administrator, 1 registered user for scanning source code and 1 floating license for web scanning.

(3) Parasoft: 1 floating license for source code scanning.

DISSIMILAR MAKE/MODEL COST IMPLICATIONS AND OTHER IMPACTS:

This is a new product purchase to effectively and efficiently comply in a timely manner with current and emergent IA STIG requirements to obtain and maintain an ATO for our NUWCDIVNPT systems. This tool will be used by both NUWCDIVNPT Code 1042 and 101 software engineers to satisfy DISA STIG requirements for our Mission Assurance Category (MAC) III Sensitive systems. IBM Security AppScan Enterprise is the only tool which has proven to meet all of our requirements to include a floating license model for source code analysis which is not tied to a named user. IBM Security AppScan Enterprise floating license model offers the best value to the Government in an environment where several engineers must occasionally scan code. NUWCDIVNPT will meet its needs with 1 floating license keeping license costs down. An equally important requirement is that IBM Security AppScan Enterprise does not charge a license cost per project source code scanning as well as not charging per named user assigned as mention above on Product Comparison Matrix chart. Meeting these cost requirements makes this selection the most cost advantage since NUWCDIVNPT has many projects/users per system.

CONCLUSION:

NUWCDIVNPT is in the need of an automated source code scanning tool to meet the IA requirements. Currently Information Management Customer Services, Code 1042 and the Human Capital Code 101 are performing these tasks manually which is taking a great burden on the limited resources which is not efficient. The selection of IBM Security AppScan Enterprise was chosen because of the extensive evaluation research and test trial done by Code 1042 which has proven to meet all of the critical requirements in a most cost effective licensing structure for our software development environment.