CaaS / SaaS Featured Article

Veracode Expands Backdoors and Malicious Code Detection

By Jai C.S., TMCnet Contributor

Veracode, a provider of on-demand application security testing solutions, has expanded its coverage for detecting backdoors and malicious code embedded in legitimate software as part of its SecurityReview solution for developers and purchasers of software.

 

Software security vulnerabilities have been a large threat to several businesses. Addressing this issue, Veracode’s on-demand model allows organizations to benefit from their application security testing technologies through an independent, standards-based security rating all through a simple, automated and cost-effective service.

 

Veracode's SecurityReview is provided as an on-demand Software-as-a-Service (SaaS (News - Alert)) solution that requires no on-premises hardware or software to upgrade or additional maintenance fees.

 

The SecurityReview application security testing service is used for measuring the security of commercial-of-the-shelf (COTS) software; analyzing your internally developed applications for security quality; reviewing offshore or outsourced code before acceptance; achieving compliance with standards such as PCI, FISMA, GLBA, SOX or HIPAA; and developing secure applications.

 

Veracode SecurityReview uses patented binary code analysis and dynamic web analysis to assess any application security threats, including vulnerabilities such as cross-site scripting (XSS), SQL injection, buffer overflows and malicious code.

 

"As organizations increasingly use third party service providers to design, build and manage their software applications, application security becomes ever more critical," said Stan Lepeak, managing director of Global Research for EquaTerra (News - Alert).

 

"Veracode's application security testing services can help fill a hole that exists in too many enterprises' testing and acceptance programs for third party developed code," added Lepeak.

 

The SANS Institute recently issued "Application Security (News - Alert) Procurement Language" which requires organizations to certify that their software does not contain malicious code, backdoors and time bombs. The State of New York and the Depository Trust and Clearing Corporation (DTCC) have adopted this language as a pre-requisite for vendors to do business with them.

 

The current announcement on the expansion of Veracode’s testing service builds upon the company’s well recognized technology and research.

 

Added to the current testing, Veracode has added the ability to detect growing threats commonly known as Time Bombs, Hardcoded Cryptographic Constants and Credentials, Deliberate Information and Data Leakage, Rootkits and Anti-Debugging techniques in applications.

 

These targeted threats, according to the company, are hidden in software and mask their presence to evade detection by traditional security technologies.

 

"Modern software development is complex and comprised of outsourced code, open source and third party libraries, which makes the insertion of backdoors and malicious code difficult to detect by traditional source code analysis and thus, an attractive attack vector," said Matt Moynahan, chief executive officer at Veracode.

 

"Veracode inspects the application binary, which is the only way to cover 100% of the application code. Verifying the binaries as part of the SDLC or purchase process is the easiest and most effective way to manage risk from backdoor and malicious code vulnerabilities," added Moynahan.

 

Company officials also stated that the new scanning technology to identify additional backdoors and malicious code will be available in Q2 2009.

 

Don’t forget to check out TMCnet’s White Paper Library, which provides a selection of in-depth information on relevant topics affecting the IP Communications industry. The library offers white papers, case studies and other documents which are free to registered users. Today’s featured white paper is Fixed Service Strategies for Mobile Network Operators, brought to you by Comverse (News - Alert).

Jai C.S. is a contributing editor for TMCnet. To read more of Jai's articles, please visit his columnist page.

Edited by Michelle Robart