Web Application and Web Service Vulnerability Tool
The Department regularly conducts risk assessments related to various State information technology systems. These risk assessments server to identify and evaluate the security posture of these systems in order to quantify and qualify compliance to various State and Federal requirements. One part of a risk assessment involves the identification of vulnerabilities within and exposed by the target of evaluation.
As more systems become web enabled, it is necessary to identify and evaluate vulnerabilities in the web applications and web services that these systems expose for interface to users and other systems.
1. What features make your product the best product for web application and web service vulnerability assessment?
2. What web technologies/environments does your product support (analyze)?
3. Is your product capable of analyzing web services? Please describe this capability.
4. Is your product capable of static code analysis? If so, what technologies/languages?
5. Please describe how your product spiders a web application and its capabilities to discover hidden items or content.
6. Please describe to what standards your product analyzes and reports to, what pre-configured policies are included, and capability to create custom policies within the product.
7. Please describe from what sources patterns for the testing and identification of vulnerabilities are derived.
8. Does the product have a method for the user to create and use custom tests? Please describe this capability, if it exists, including APIs, interfaces, etc/ 4
State of Connecticut, Department of Information Technology Request for Information (RFI)
RFI #10ITZ0079 August 20, 2010
9. Please describe how your product reduces false positives and false negatives. Please provide any available metrics on false positives and negatives reported by your product.
10. Please describe the update procedure for your product. Is it automatic? Approximately how often are updates available?
11. Does your product incorporate a fuzzing capability? Is it automatic, manual, or both?
12. Please describe the licensing models for your product.
13. Please describe how your product stores, and makes available for reuse, previous scans. What database technology is used? Is it included with the product?
14. What are the system and architecture requirements for your product?
15. Is your product SCAP compliant - has it been validated by the NIST SCAP Validation Program to the current effective version of SCAP?
16. Please describe the reporting capabilities of your product. What formats and layouts are provided / supported? Are reports customizable? If so, how?
17. Does your product perform analysis and provide reports relative to Federal regulatory requirements such as HIPAA, IRS 1075, and SSA?
18. Please supply the LIST prices of your product for initial purchase and license renewals
19. Please describe the availability, cost, and logistics of training related to your product.
