Black Duck debuts U.S. encryption compliance
Software can search source code for munitions-level crypto
IDG News Service - Black Duck Software Inc. is extending the scope of its compliance management offerings with a new product to handle U.S. export encryption requirements.
Available Monday, the company's exportIP software will enable users to search their source code to identify any encryption algorithms and ascertain whether the encryption complies with rules enforced by the U.S. Department of Commerce's Bureau of Industry and Security (BIS).
The rules forbid the export of powerful encryption algorithms to Cuba, Iran, North Korea, Sudan and Syria. The BIS can impose serious penalties on companies violating those rules including fines and a denial of export privileges.
Black Duck is launching exportIP at the Update 2006 Conference on Export Controls and Policy which is being hosted by the BIS and taking place in Washington through Tuesday.
"We're helping companies to understand the contents of their code so they can identify any intentional or unintentional use of encryption or encryption algorithms buried in the code," said Doug Levin, the company's chief executive officer and president.
Black Duck has been working on exportIP for about a year, he added. For the immediate future, the vendor will focus on U.S. regulations, but it could potentially localize exportIP for use in other countries with similar encryption rules.
The company will target not only developers but any organization whose products for export include embedded software such as phone handsets and computers, Levin said.
Black Duck already sells protexIP, compliance software and services to help companies analyze their development projects to determine whether they contain any pieces of open-source or other third-party code and then ensure that those code fragments meet the required licensing obligations.
At present, exportIP and protexIP are separate products, Levin said. They are designed to run on separate Windows or Linux servers since they have their own distinct analytics engines and knowledge bases.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts