United States government regulation compliance

Compliance with United States government security and information technology regulations help to remove sales impediments and roadblocks. It also provides a proof point to prospects worldwide that HCL® is working to make their products the most secure in the industry. This topic lists the standards and guidelines that AppScan® Source supports.

Internet Protocol Version 6 (IPv6)

AppScan Source is enabled for IPv6, with these exceptions:

  • Inputting IPv6 numerical addresses is not supported and a host name must be entered instead. Inputting IPv4 numerical addresses is supported.
  • IPv6 is not supported when connecting to Rational Team Concert™.

Federal Information Processing Standard (FIPS)

On Windows™ and Linux™ platforms that are supported by AppScan Source, AppScan Source supports FIPS Publication 140-2, by using a FIPS 140-2 validated cryptographic module and approved algorithms.

To learn background information about AppScan Source FIPS compliance - and to learn how to enable and disable AppScan Source FIPS 140-2 mode, see these technotes:

National Institute of Standards and Technology (NIST) Special Publication (SP) 800-131a

NIST SP 800-131A guidelines provide cryptographic key management guidance. These guidelines include:

  • Key management procedures.
  • How to use cryptographic algorithms.
  • Algorithms to use and their minimum strengths.
  • Key lengths for secure communications.

Government agencies and financial institutions use the NIST SP 800-131A guidelines to ensure that the products conform to specified security requirements.

NIST SP 800-131A is supported only when AppScan Source is operating in FIPS 140-2 mode. To learn about enabling and disabling AppScan Source FIPS 140-2 mode, see Federal Information Processing Standard (FIPS).

Important:
If the AppScan Enterprise Server that you will connect to is enabled for NIST 800-131a compliance, you must set AppScan Source to force Transport Layer Security V1.2. If Transport Layer Security V1.2 is not forced, connections to the server will fail.
  • If you are not installing the AppScan Source Database (for example, you are only installing client components), you can force Transport Layer Security V1.2 by modifying <data_dir>\config\ounce.ozsettings (where <data_dir> is the location of your AppScan Source program data, as described in Installation and user data file locations)). In this file, locate this setting:
    <Setting
		 name="tls_protocol_version"
		 read_only="false"
		 default_value="0"
		 value="0"
		 description="Minor Version of the TLS Connection Protocol"
		 type="text"
		 display_name="TLS Protocol Version"
		 display_name_id=""
		 available_values="0:1:2"
		 hidden="false"
		 force_upgrade="false"
	/>

    In the setting, change value="0" to value="2" and then save the file.

  • If you are installing the AppScan Source Database, you force Transport Layer Security V1.2 in the HCL® AppScan Enterprise Server Database Configuration tool after installing both AppScan Source and the Enterprise Server.

Windows machines that are configured to use the United States Government Configuration Baseline (USGCB)

AppScan Source supports scanning applications on Windows machines that are configured with the USGCB specification.

Note: On machines that are configured with the USGCB specification, AppScan Source does not support defect tracking system integration with HP Quality Center or Rational® ClearQuest®.