2014 Digital Yearbook of Homeland Security Awards

GSN 2014 Digital Yearbook of Homeland Security Awards Recipients
Vendors of IT Security Products and Solutions
Applied Visions, Inc. / Secure Decisions
Division – 2014 Winner
Awards Category:
––––––––––––––––––––––––––––––––––––––––
Best Compliance/Vulnerability Assessment Solution
Name of Nominated Product, Service,
or Program:
––––––––––––––––––––––––––––––––––––––––
Code Dx ®
Reason this entry deserves to win:
––––––––––––––––––––––––––––––––––––––––
Corporate and government enterprises are all potential
victims of cyber-attacks that can adversely impact a
company’s bottom line, damage public reputation,
compromise sensitive government data, and diminish
the public trust. Industry experts and the Department
of Homeland Security (DHS) have traced most compromises
to poorly written software. 70-80% of security
breaches occur because of poorly written code containing
numerous security vulnerabilities. Consequently,
software development and acquisition organizations
are under increased pressure to find and fix software
vulnerabilities before they are deployed. DHS, NASA,
DoD and commercial businesses have begun to use
static application security testing (SAST) tools to find
software vulnerabilities during the development cycle
and as part of the acquisition process. One problem,
however, is that no single source code analysis tool finds
most of the vulnerabilities in an application. Different
tools identify different vulnerabilities. Benchmark tests
by NIST and NSA reveal that, on average, a single static
analysis tool will detect only 14% of all of the software
weaknesses in code. Consequently, one needs to use
multiple source code analysis tools to find a majority of
the vulnerabilities. A second problem is that each tool
outputs its results in a different format with different
severity scales, making it difficult to combine the results
and present them in a unified report. A third problem
is related to expense: each commercial tool added to
the vulnerability analysis adds significant cost; and each
open-source SAST tool requires additional resources to
find and configure them. Code Dx ® finds, prioritizes,
and visualizes software vulnerabilities – fast and afford-
38