IBM Security AppScan® Open Mic – May 18, 2016 How to apply Fixes in the AppScan products Panelists Joe Lacy, Presenter - AppScan Standard/Enterprise engineer Marek Stepien, Presenter – Knowledge Lead Scott Hurd – AppScan Support Engineer Karl Weinert – AppScan Source Support Engineer Joe Kiggen, Moderator – AppScan Support Manager Reminder: You must dial-in to the phone conference to listen to the panelists. The web cast does not include audio. USA: 866-803-2145 Toll: +1-210-795-1099 Participant passcode: 5945822 Slides and international phone numbers: in the Open Mic Webcast NOTICE: By participating in this call, you give your irrevocable consent to IBM to record any statements that you may make during the call, as well as to IBM's use of such recording in any and all media, including for video postings on YouTube. If you object, please do not connect to this call. 1

Goal of session To better understand the release cycle for AppScan products (AppScan Standard, AppScan Enterprise, and AppScan Source), and how to apply fixes to the AppScan Standard/Enterprise products. 2

Table of contents / Agenda Presentation AppScan Releases, FixPacks, Fixes AppScan Standard issues AppScan Enterprise issues AppScan Source issues Demo How to install an iFix in AppScan Standard How to install an iFix in AppScan Enterprise 3

AppScan Releases, FixPacks, Fixes Releases (major release) - One or two Releases a year - Releases of the AppScan products (Standard, Enterprise, Source) are coordinated, and released at the same date. - May include major changes of the functionality or new functionality - The version number includes two or three digits, for example 8.8 or 9.0.3 - Go through comprehensive QA testing - includes its own on-line product documentation, and its own download document - Release downloads are available at Passport Advantage FixPacks - One or two FixPacks a year, some of them are coordinated - Includes a collection of fixes, and sometimes includes minor functionality changes - The version number includes four digits, for example 9.0.3.1, or 9.0.3 FixPack 1 - Does not have its own on-line product documentation, but it has it's own download document - All FixPacks are available at IBM Fix Central; Some Fixpacks are also available at Passport Advantage or through automatic updates. 4

AppScan Releases, FixPacks, Fixes (cont.) iFixes (Interim Fixes) - iFixes are produced when needed, usually several fixes for each release and FixPack - Includes a collection of fixes to existing functionality in the base release - Version number is as for example 9.0.3 iFix003 or 9.0.3.1 iFix001 - Functionally tested (it does not go through weeks of comprehensive testing) - Described in Readme file that is included in the package - iFixes are publically available at IBM Fix Central, or through automatic updates LA Fixes (Limited Availability Fix) - A fix for a specific APAR - LA fixes are produced when needed - functionally tested (it does not go through weeks of comprehensive testing) - described in Readme file - LA fixes are sent by AppScan support when needed to fix a specific issue. Security rules update - includes updates to the test policies (test definitions) - discussed later 5

AppScan Standard issues Releases - downloaded from Passport Advantage and installed manually - cannot be installed through the automatic update FixPacks - installed through the automatic update, or manually from IBM Fix Central - needs the base release installed to apply a FixPack (with exception of FixPack version 9.0.3.2) iFixes - installed through the automatic update, or manually from IBM Fix Central LA Fixes - Sent by support engineer; Security rules updates - released every 2-3 weeks; - included also in every Release and FixPack 6

AppScan Standard issues (cont.) Supported Releases and FixPacks – technote #1971041 7

AppScan Enterprise issues Releases - download from Passport Advantage FixPacks - The download includes the entire release with the installation package; download from from IBM Fix Central iFixes - Installed manually, downloaded from IBM Fix Central - Note: may be complex to install LA Fixes - Sent by AppScan support Security rules updates - included in every major release and FixPack, and in some specific iFixes - Currently there are NO standalone security rules updates for AppScan Enterprise (even if AppScan Enterprise has functionality to install them) Because the iFixes for AppScan Enterprise are publically available, a lot of customers download them, and some of them ending up to call us, AppScan support because side effect issue. This prompted us to address the issue in this open mic. 8

AppScan Enterprise issues (cont.) Supported Releases and FixPacks – technote #1971043 Because the iFixes for AppScan Enterprise are publically available, a lot of customers download them, and some of them ending up to call us, AppScan support because side effect issue. This prompted us to address the issue in this open mic. 9

AppScan Source issues Releases FixPacks iFixes Security rules updates - from Passport Advantage FixPacks - Available for download from IBM Fix Central; Some of the FixPacks are also available from Passport Advantage - The download includes the entire release with the installation package iFixes - Can be installed manually after downloading them from IBM Fix Central LA Fixes - Sent by support engineer Security rules updates - No Security Rules for Source. - There is Supported Language Markup which is updated together with releases and FixPacks; no separate downloads 10

AppScan Source issues (cont.) Supported Releases and FixPacks – technote #1971044 11

Demo How to install an iFix in AppScan Standard How to install an iFix in AppScan Enterprise 12

Questions for the panel? Now is your opportunity to ask questions of our panelists. To ask a question now: Press *1 to ask a question over the phone or Type your question into the IBM Connections Cloud Meeting chat To ask a question after this presentation: You are encouraged to participate in our Forum topics AppScan Source forum .

IBM Support Portal | Sign up for “My Notifications” Where do you get more information? Questions on this or other topics can be directed to the product forum: AppScan Source forum. More articles you can review: Technote: AppScan Standard releases available AppScan Enterprise releases available AppScan Source releases available How to check the patch level in AppScan Enterprise AppScan Releases, Fixpacks, fixes IBM Knowledge Center: <link to product welcome page> Useful links: How to Contact IBM Software Support for IBM Security IBM Support Portal | Sign up for “My Notifications” Follow us:

Mandatory closing slide with copyright and legal disclaimers. 15