The Federal Risk and Authorization Management Program (FedRAMP) announced the first cybersecurity software-as-a-service to gain accreditation Wednesday, approving use of HP’s Fortify on Demand (FoD).
The product allows agencies to perform vulnerability assessments for apps and websites through a cloud model, without having to download and manage the software themselves. Systems are scanned at the code layer and assessed on more than 600 vulnerability categories then reviewed by an HP static auditor.
Related: Early comments provide focus for FedRAMP high baseline
HP CTO of Public Sector Enterprise Security Products Rob Roy noted 70 percent of breaches at federal agencies gain access through software vulnerabilities.
“As the soft underbelly of an agency’s network, software can impose serious threats to an agency’s security if vulnerabilities are not proactively identified and addressed,” Roy said. “As the only solution of its kind available with FedRAMP certification, HP Fortify on Demand quickly addresses the root cause of vulnerabilities by securing software from conception through the entire development lifecycle.”
The SaaS product was authorized at the moderate level by third-party assessment organization Lunarline.
