Strengths: Reviews code for security vulnerabilities
Weaknesses: Designed more for programmers than security personnel because of difficulty in running the product
Verdict: For any organisation that uses a system development life cycle, this should be a welcome addition. Recommended
Ounce 4 is another software-based solution that is actually a CASE (computer-aided software engineering) utility. It works by reviewing code for any application to scan for security vulnerabilities before the code is posted to a development or production server. This type of utility is routinely mentioned in the PCI DSS compliance document and should be included in any organisation's system development life cycle.
The utility ships with a demo data CD that allows the tester to review non-production code to get a feel for the application and the function. This feature was well received in the lab and made for a stronger feeling of understanding before a tester would evaluate actual production data. The dashboard for the application was straightforward to use with panes logically laid out.
Ounce 4 includes the ability to compare what it finds to sets of codes and show the differences. It can also triage coding errors, repair the error and scan again. Results can be published to a web server or reports can be generated to distribute.
The installation of Ounce 4 was as straightforward as possible. A few clicks of the mouse and a quick browse to the licence file and the installation work was finished. The install did take some time to complete, however, because of the large amount of data being installed. Helper applications and language kits were installed behind the scenes, transparent to the user deploying the product.
Ounce 4 arrived with a guide for the initial installation and use of the product in hard-copy format. Several PDF documents accompany the installation files on the dedicated CD. The PDF files are indexed and searchable to make finding things faster.
Support is offered via phone, and a detailed web portal that allows for the opening of tickets, feature requests, and a knowledge base. Phone support is offered during office hours.
The pricing for Ounce 4 starts at £750 for an annual licence and £1,350 for a perpetual licence. This puts it at the low end of the price spectrum.