(1) Micro Focus provides an end-to-end application security solution called Fortify that integrates security testing into the software development lifecycle from development through production. (2) Micro Focus also provides ALM Octane to support agile development practices and continuous delivery. It manages requirements, backlogs, tests and defects throughout the development process. (3) Micro Focus offers an integrated platform that connects development, testing, release, and operations to enable continuous exploration, continuous development and testing, continuous deployment, and continuous feedback.

1. “Imagine Digital Safety Assured”
Arno van de Velde
Presales Consultant Application
Delivery Management
Micro Focus

2. Digital Safety?
Image from Templarbit.com, data from Verizon Data Breach
report 2018

3. History
Images from https://www.w3schools.in/sdlc-tutorial/v-model/ and https://www.w3schools.in/sdlc-tutorial/agile-model/

5. Planning
App
Development
App Testing App release
Release
decision
Business
Demand
Deployed
App
Companies are adopting DevOps for rapid development
Increase Automation Reduce Latency Increase Visibility
Security?
Security teams can’t keep up as development teams are growing at an 80:1 ratio
Source: Micro Focus 2017 Application Security Research Update
…but security is often outside of the process

6. FORTIFY
Security must be integrated into the New SDLC
6
Improve SDLC Policies
Application security for the SDLC
Continuous Monitoring and
Protection
Monitor and protect software
running in Production
3
Security Testing
Embed scalable security into
the development tool chain
2
Secure Development
Continuous feedback on the
developer’s desktop at DevOps
speed
1

7. 7
Fortify provides a flexible end-to-end AppSec solution with
on premises, on-demand, and hybrid models
Web Dynamic Testing
(DAST)
Runtime Protection
(RASP)
Static Code Analysis
(SAST)
Production
Fortify on Demand
Application Defender
Application Development
Test,
Integration
& Staging
CodeDesign
IT Operations
On
Premises
On
Demand
WebInspect
Software Security Center (SSC)
Static Code Analyzer (Fortify SCA)
Software Development Lifecycle (SDLC)

8. 8
Fortify Software Security Center

9. 9
That sounds nice… but…?

10. 10
Micro Focus ALM Octane
Requirement
Management
Backlog
Management
Team Backlog
Management
Dashboard
Defects
Management
Pipeline
Management
My Work Quality
Management

11. Bringing an Innovative Approach to Testing with ALM
Octane
Features
User
Stories
Epics
Code
Changes
Branches
Production
Test
Defects Test run
Application Modules
Requirements
Pipelines
ALM
OCTANE
Including OOTB Devops
integrations !

12. 12
ALM Octane

13. Let me see this!
13

14. Application Delivery with Micro Focus
Service
Management
Service
Requests
Production
Insights
Pipeline Triggering
Code and
Changesets
Product/Portfolio
Management
Continuous
Delivery (CD)
SCCM
IDE
Epics, Priorities
Progress, Quality
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
7
10
3
4
Release Orchestration
Planning, Control, Compliance, Governance
8Epics, Projects, Releases
Status and Test
Orchestration
Status, Epics
and Stories
Status and Deployment
Orchestration
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Orchestration
Environment
Provisioning
9Deployment Triggering
Triggers
Environment Provisioning
Asset Sharing
Production Insights
Service
Reliability
11
User Stories and
Defects
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Status and Deployment
Execution
Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Plan | Govern (Continuous
Exploration
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)
Develop | Test (continuous
Develop & Test)

15. Product/Portfolio Management
Product/Portfolio
Management
1
Product/Portfolio Management
Record business demands and
ideas, align with strategic
priorities, track actual costs, and
collectively manage projects with
Project & Portfolio Management
(PPM) to ensure projects are
delivered on-time and on-budget.
PPM offers integrations with other Micro
Focus products and third-party products,
such as:
• Atlassian JIRA
• CA Agile Central (Rally)
• VersionOne
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

16. Agile, DevOps and Lifecycle Management
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Manage backlogs, user stories, requirements, defects, and overall quality coupled
with real-time collaboration, cross-project visibility, and insights. Use ALM Octane
for lean, Agile and DevOps, and ALM/Quality Center for traditional management.
Configure and maintain integrations using Micro Focus Connect as an extensible
framework.
Reuse requirements with Dimensions RM to manage change across tools, teams
and releases for complex development projects.
These solutions offer integrations with other Micro Focus products and numerous third-party
products.
Users may expand their integrations to applications of their choice by using REST API, OData, and
SDKs.
Additional integrations are also available in the Micro Focus AppDelivery Marketplace.
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

17. Development (IDE)
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
IDE
Tasks appear inside the developer’s IDE. A
developer clicks on a task to start working on
it, implements the code, and pushes the
changes to a Source Code & Configuration
Management (SCCM) system.
These solutions offer integrations with the following
development IDEs:
• IntelliJ IDEA
• Eclipse Oxygen
• Microsoft Visual Studio IDE
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

18. Source Code & Configuration Management (SCCM)
SCCM
All code, tests and configuration changes are
maintained in the SCCM. Enable developers to use
their preferred Git client with Dimensions CM, and
support multiple disparate Git repositories within a
centralized and highly secured back end repository.
These solutions offer integrations with the following SCM tools:
• Git
• Atlassian Bitbucket
• Microsoft Azure DevOps Server (formerly TFS)
• Apache Subversion
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

19. Continuous Integration (CI)
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Continuous Integration (CI)
The CI server monitors the SCCM tool, and
whenever it detects that code has been
pushed, it triggers a new build, deploys it
on a test platform and runs tests on it. The
build status and its results are synced with
ALM Octane and ALM/Quality Center for
traceability and analysis.
These solutions offer integrations with the following
CI servers:
• Jenkins
• TeamCity
• Atlassian Bamboo
• Microsoft Azure DevOps Server (formerly TFS)
• GitLab
• GoCD
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

20. Continuous Testing
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Automated tests are part of the CI process and are run across
various operating systems and configurations
Continuous Testing
a. Functional Tests
Automated functional tests are run by Micro Focus’ Functional
testing solutions using the on-demand lab for mobile and web
tests, and leveraging existing open source scripts.
b. Performance Tests
Large-scale, cloud-based multi-technology performance tests
are run by Micro Focus’ Performance testing solutions to
detect performance bottlenecks early in development, while
leveraging existing open source scripts.
c. Security Tests
Security is embedded in the CI process through static and
dynamic analysis with Fortify to help catch security
vulnerabilities before they make it into production.
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

21. Continuous Delivery (CD)
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Pipeline Triggering
Continuous
Delivery (CD)
7
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Deployment
Execution
Continuous Delivery (CD)
Streamline deployments with drag-and-
drop process design, orchestrate complex
deployments and fully align deployment
and testing across multiple application
pipelines with Deployment Automation.
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

22. Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Pipeline Triggering
Continuous
Delivery (CD)
7
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Deployment
Execution
Release Orchestration
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Release Orchestration
Use Release Control to track, co-
ordinate, orchestrate and govern
all aspects of enterprise IT
delivery. Seamlessly integrate and
gain visibility into Planning,
Development, Testing,
Deployment and Operations from
a single point of process control.
Release Orchestration
Planning, Control, Compliance, Governance
8
Status and Test
Orchestration
Status, Epics
and Stories
Status and Deployment
Orchestration
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

23. Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Pipeline Triggering
Continuous
Delivery (CD)
7
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Deployment
Execution
Environment Provisioning
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Environment Provisioning
Design, deliver and manage
hybrid environments using
any cloud, container or
infrastructure to streamline
delivery using Hybrid Cloud
Management. Easily create
realistic simulations using
Service Virtualization and
Network Virtualization.
Release Orchestration
Planning, Control, Compliance, Governance
8
Status and Test
Orchestration
Status, Epics
and Stories
Status and Deployment
Orchestration
Status and Orchestration
Environment
Provisioning
9Deployment Triggering
Triggers
Environment Provisioning
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

24. Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Pipeline Triggering
Continuous
Delivery (CD)
7
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Deployment
Execution
Service Management
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Release Orchestration
Planning, Control, Compliance, Governance
8
Status and Test
Orchestration
Status, Epics
and Stories
Status and Deployment
Orchestration
Status and Orchestration
Environment
Provisioning
9Deployment Triggering
Triggers
Environment Provisioning
Service
Management
Service
Requests
Production
Insights
10
Service Management
If an issue arises in
production, users can open
support tickets with
Service Management
Automation (SMA), which
are entered as defects in
ALM Octane for
subsequent investigation
and resolution by the
application delivery team.
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

25. Continuous Testing
Functional Testing
Performance Testing
Security Testing
Virtualization
Mobile
Test
Execution
6
Pipeline Triggering
Continuous
Delivery (CD)
7
Triggers Application
Deployment &
Configuration
DEVELOPMENT
ENVIRONMENT
QA
ENVIRONMENT
PRODUCTION
ENVIRONMENT
Status and Deployment
Execution
Service Reliability
Epics, Priorities
Progress, Quality
Product/Portfolio
Management
1
Agile, DevOps and Lifecycle Management
Requirements, Backlog, Tests and Defects Management, Releases and Sprints Management
2
IDE
3
User Stories and
Defects
Code and
Changesets
SCCM
4
Pipeline Triggering
Code / Changesets
Artifact Capture
Continuous
Integration (CI)
5
Status and
Test Execution
Release Orchestration
Planning, Control, Compliance, Governance
8
Status and Test
Orchestration
Status, Epics
and Stories
Status and Deployment
Orchestration
Status and Orchestration
Environment
Provisioning
9Deployment Triggering
Triggers
Environment Provisioning
Service
Management
Service
Requests
Production
Insights
10
Service Reliability
Applications in production are
continuously monitored for
user experience and
performance issues.
Production insights from
Operations Bridge and
Application Performance
Management are fed back to
the team to help them
optimize testing, tune
performance, and pro-actively
detect and resolve issues.
Asset Sharing
Production Insights
Service
Reliability
11
Plan | Govern (Continuous
Exploration
Develop | Test (continuous
Develop & Test)
Deploy | Release
(Continuous Deployment
Operate | Monitor
(Continuous Feedback)

26. 26
Should Security Testing results only
be handled by the security team?
YES!
“If everybody can see potential
security flaws, the more risk we
have!”
NO!
“We need to speed up delivery and
we’ve become the new bottleneck”

27. Build and deliver better,
more SECURE software
faster