Micro Focus Fortify Software Security Center User Guide

1 Micro FocusFortify Software Security CenterSoftware Version: GuideDocument Release Date: June 2018 Software Release Date: May 2018 Legal NoticesMicro Focus The Lawn22-30 Old Bath RoadNewbury, Berkshire RG14 1 WarrantyThe only warranties for products and services of Micro Focus and its affiliates and licensors ( Micro Focus ) are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein.

2 The information contained herein is subject to change without Rights LegendConfidential computer Software . Except as specifically indicated otherwise, a valid license from Micro Focus is required for possession, use or copying. Consistent with FAR and , Commercial Computer Software , Computer Software Documentation, and Technical Data for Commercial Items are licensed to the Government under vendor's standard commercial Notice Copyright 2008 - 2018 Micro Focus or one of its affiliatesTrademark NoticesAdobe is a trademark of Adobe Systems and Windows are registered trademarks of Microsoft is a registered trademark of The Open UpdatesThe title page of this document contains the following identifying information.

3 LSoftware Version number lDocument Release Date, which changes each time the document is updated lSoftware Release Date, which indicates the release date of this version of the softwareTo check for recent updates or to verify that you are using the most recent edition of a document, go to: ( )Page2of325 ContentsPreface14 Contacting Micro Focus Fortify Customer Support14 For More Information14 About the Documentation Set14 Change Log15 Chapter 1: Introduction23 Intended Audience23 Document Structure23 What's New in Micro Focus Fortify Software Security Center User Interface for Token Management24 New Token Type for Plugin24 Oracle Database Partitioning24 Consolidated Proxy Settings24 Changed Bug Tracker Implementation25 Changed Password Requirements25 Audit Assistant Automatic Auditing25 New Reports25 Related Documents25 All Products26 Micro Focus Fortify CloudScan27 Micro Focus Fortify Software Security Center27 Micro Focus Fortify Static Code

4 Analyzer28 Micro Focus Fortify WebInspect30 Micro Focus Fortify WebInspect Enterprise31 Part I: Deploying Fortify Software Security Center33 Chapter 2: Providing for Secure Deployment34 Securing Access to Facilities34 Securing Tomcat Server34 UserGuideMicroFocusFortifySoftwareSecuri tyCenter( )Page3of325 Setting Tomcat Server Attributes to Protect Sensitive Data in Cookies34 About Using HTTPS and SSL Communications35 Configuring and Fortify Static Code Analyzer Tools to Communicate with Fortify Software Security Center Using HTTPS35 About Securing Passwords and User Roles36 Managing Computer Services and Accounts36 Chapter 3.

5 Preparing for Fortify Software Security Center Deployment37 High-Level Deployment Tasks37 Deployment Overview38 The Fortify Software Security Center Installation Environment40 Downloading Fortify Software Security Center Files42 Unpacking and Deploying Fortify Software Security Center Software42 About the Fortify Software Security Center Database43 About JDBC Drivers44 Adding the JDBC Driver to Fortify Software Security Center44 About Fortify Software Security Center Database Character Set Support45 Installing and Configuring the Database Server Software45 Database User Account Privileges45 Database-Specific Configuration Requirements46 Using a Microsoft SQL Server Database46 Configuring a MySQL Database47 Configuring an Oracle Database49 Preventing the No more data to read from socket Error49 Partitioning an Oracle Database for Improved Performance49 Preparing to Partition an Oracle Database49 Partitioning the Database50 Increasing the Number of Job Execution Threads50 About the Fortify Software

6 Security Center Database Tables and the Schema50 About Seeding the Fortify Software Security Center Database51 Permanently Deleting a Fortify Software Security Center Database51 ldap User Authentication52 About Fortify Software Security Center User Authentication52 Preparing to Configure ldap Authentication53 About the ldap Server Referrals Feature54 Disabling ldap Referrals Support54 Chapter 4: Deploying Fortify Software Security Center in Tomcat Server55 About the Directory56 UserGuideMicroFocusFortifySoftwareSecuri tyCenter( )Page4of325 Directory Structure56 About Secure Deployment57 About Deploying Fortify Software Security Center in Apache Tomcat57 Tomcat Memory Settings57 About Configuring the Tomcat Connectors57 Configuring Tomcat to Unpack WAR Files58 Deploying Fortify Software Security Center in Tomcat Server58 Chapter 5.

7 Configuring Fortify Software Security Center for the First Time59 Chapter 6: Logging in to Fortify Software Security Center64 Chapter 7: Additional Fortify Software Security Center Configuration65 Accessing the Configuration Settings in the ADMINISTRATION View65 Configuring Issue Stats Thresholds66 How Average Days to Review and Average Days to Remediate are Calculated66 Setting the Issue Stats Thresholds66 Setting the Legacy User Interface as the Default User Interface67 Disabling the Legacy User Interface68 Configuration Options Available in the ADMINISTRATION View68 About Audit Assistant71 Audit Assistant Workflow71 Getting a Fortify

8 Scan Analytics Authentication Token72 Configuring Audit Assistant73 Mapping Audit Assistant Analysis Tag Values to Fortify Software Security Center Custom Tag Values74 Configuring Fortify Software Security Center for BIRT Reporting78 Enabling Java Security Manager78 Creating a Database Account for Reporting78 Allocating Memory for Report Generation79 Setting Report Generation Timeout79 Configuring CloudScan Monitoring in Fortify Software Security Center80 Configuring Core Settings80 About Configuring a Proxy for Rulepack Updates84 Configuring Email Alert Notification Settings84 Setting the Strategy for Resolving Issue Audit Conflicts85 Configuring Java Message Service Settings87 Configuring ldap Servers87 Editing an ldap Server Configuration97 Importing an ldap Server Configuration97 UserGuideMicroFocusFortifySoftwareSecuri tyCenter( )

9 Page5of325 Registering ldap Entities98 Refreshing ldap Entities Manually101 Deleting an ldap Server Configuration101 Configuring a Proxy for Fortify Software Security Center Integrations102 About the SAP NetWeaver Plugin for Fortify Software Security Center103 Setting up the NetWeaver Plugin104 Adding the SAP JCo Driver to Fortify Software Security Center104 Connecting to SAP NetWeaver104 Configuring Job Scheduler Settings105 Setting Job Execution Priority109 Canceling Scheduled Jobs109 Configuring Browser Access Security for Fortify Software Security Center110 Configuring Fortify Software Security Center to Work with Single Sign-On111 Configuring Fortify Software Security Center to Work with a Central Authorization Server112 Setting up Kerberos Authentication with Fortify Software Security Center113 Configuring Fortify Software Security Center to Work with SAML Single Sign-On Solutions114 Troubleshooting116 Configuring Fortify Software Security Center to Work with Single Sign-On and Single Logout

10 Solutions that use HTTP Headers117 Configuring Fortify Software Security Center to use Certification-based SSO118 Configuring Web Services to Require Token Authentication118 Chapter 8: Additional Installation-Related Tasks120 Blocking Data Export to CSV Files120 Configuring an Eclipse Plugin Update Site120 About Bug Tracker Integration121 Managing Bug Tracker Plugins121 Adding Bug Tra