HP BAC integration

Heard rumour that there's rumour of some AMP integration with BAC...would love to know more if it's true! So, spill the beans please...

 Sorry for the late reply.

We have been looking across all of the HP BTO solutions for good integration fits with AMP.  At this time there are not any hard dates on when differentintegrations will be available but BAC is one area that we are exploring.

Can you give me some thoughts on what you see in a BAC integration?  I would love to include you feedback in our exploration.

 

Jeff Morgan

AMP Product Manager

Ideas for BAC integration:

• Security as a KPI. Can then setup SLA's around security.
• uCMDB integration - link settings and reports to CIs (probably leave AMP to control access to vulnerability reports tho, for security's sake).
  
• uCMDB integration - run server profiler as part of the 'discovery' process.
• uCMDB integration - link URLs (as 'Web Application' CIs) to 'WebServer' CIs (so when a webserver is found, one can state what URLs can be accessed on it) and automatically schedule scans against those URLs...linking results to the CIs.
• Direct WebInspect to BAC communication (i.e. no AMP, feed high-level info to BAC where it can be factored into reports).

Ideas for leveraging Vugen scripts:

• Automagically create macros from Vugen scripts.
• Automagically create Web-Form Values file from Vugen script and parameters.

I will be presenting on this subject at HP Universe (June 16th to 18th @ The Venetian, Las Vegas). Particularly talking about WebInspect + SiteScope + BAC integration and the use of VuGen for automating Code Injection and Predictable Resource Location exploits. Hoping to meet and talk with plenty of WebInspect users, so if anyone from this forum is there lets have a chat!