My name is Bhavna Sarathy, Product Manager. I have been with Veracode for the last 4+ years. I manage the DAST product line that includes Discovery & Dynamic Analysis and the IAST product. I want to share with you the Dynamic Analysis features that my team is working on this quarter. We are a DevOps team and we ship features throughout the quarter. Look for SHIPPED notation below for features you can access today!

Certificate-based Authentication

For those of you who want to scan websites using a client certificate, Dynamic Analysis will support Certificate-based Authentication to upload a certificate to login to the website.

Crawl Scripts with prescan and troubleshooting assistance

Crawl scripts provides a pre-recorded crawl sequence to supplement the Veracode scan engine's automated crawl to potentially increase Dynamic Analysis scan coverage. Crawl scripts will be validated at upload time and prescan functionality will be extended to crawl scripts. Crawl script feature will support Selenium SIDE and HTML formats. 

Prescan Workflow Improvements - SHIPPED

Last quarter (CYQ1 2020), Dynamic Analysis released the following prescan and Authentication improvements.

1. Expanded Auto Login to cover browser-based authentication and NTLMv2
2. Prescan Screenshot for login scripts
3. Prescan Details Modal

This quarter (CYQ2 2020) we worked on more prescan workflow improvements to streamline prescan configuration. Here's a sneak preview, see Release Notes for all changes.

•  Do Not Schedule option on Schedule page has been replaced with 2 separate options:

1. Prescan – Kickoff a prescan to ensure connection and authentication have been entered correctly. Use Prescan details modal and Prescan screenshot to work through any issues.
2. Save for Later – If you are not ready to run a scan because you don’t have the schedule yet, you can configure the scan and save for later

Scan Status and end-user Visibility Improvements

Increase End-User visibility into scans where the duration has ended & where the application has lost connection.

·      Increase End-User Visibility into Scans that End Time & Port Shutdown so that fewer Support Incidents and Escalations are raised

·      Logged-in / Logged-out Screenshot Comparison tool to allow Customers to self-service

ISM Notification Improvements

Based on your feedback, the ISM Endpoint Notification is being improved to include the endpoint name to simplify the process of figuring out which endpoint is offline and needs to be brought back online. Also, ISM Gateway issues are totally on Veracode to fix and we will not be sending notifications to customers when the Gateway goes down, as this causes confusion with our customers.

·      ISM Endpoint email notification provides the name of the endpoint

·      ISM Gateway email notification is no longer sent to customers

ISM Endpoint DSE Access Duration Configuration

Configuration option to manage the ISM Endpoint DSE Access, i.e. how long do you want to keep the DSE access open to get assistance from Veracode and when would you like it to automatically close.

Recurring Scans can be set up 90 days in advance - SHIPPED

Dynamic Analysis now provides the ability to select a start date up to 90 days in the future. This enhancement enables you to initiate a one-time scan immediately as well as schedule a recurring, quarterly scan of the same Dynamic Analysis.

New Selenium commands supported - SHIPPED

Dynamic Analysis now supports these Selenium commands: 

keyUp, keyDown, keyPress, assertTextPresent, waitForElementVisibile, and clickAt.

Dynamic Analysis on status.veracode.com

Provide information to the status page to identify if the Dynamic Analysis service is available or unavailable,