AppScan (formerly Rational AppScan) is an application security testing solution acquired by HCL Technologies from IBM in late 2018. Appscan supports both dynamic (DAST) and static (SAST) application security testing.
GIT is good to be used for faster and high availability operations during code release cycle. Git provides a complete replica of the repository on the developer's local system which is why every developer will have complete repository available for quick access on his system and they can merge the specific branches that they have worked on back to the centralized repository. The limitations with GIT are seen when checking in large files.
In HCL AppScan automation maintain a reasonable pace of review and remediation of flaws for our apps. HCL AppScan is a cloud-based enterprise mobile application security testing solution for Android and iOS applications developed using Java, .Net or Objective-C. So it covers all our area and It consists of three components: AppScan Source Edition for developing and testing apps internally, AppScan Standard Edition for testing internally or externally, and AppScan Enterprise Edition for large enterprises who need to secure their entire mobile application portfolio across the organization with multiple device types.
AppScan works well in finding application vulnerabilities such as SQL injection, cross-site scripting and all of the OWASP top 10.
Flexible reporting allows us to generate executive reports for application owners as well as separate technical reports for developers and system engineers.
Technical reports include remediation information and cross reference CVSS scores
Because it maintains data on all repeated assessments it helps us to do trending and metrics on compliance
Git has met all standards for a source control tool and even exceeded those standards. Git is so integrated with our work that I can't imagine a day without it.
I am not sure what the official Git support channels are like as I have never needed to use any official support. Because Git is so popular among all developers now, it is pretty easy to find the answer to almost any Git question with a quick Google search. I've never had trouble finding what I'm looking for.
I've used both Apache Subversion & Git over the years and have maintained my allegiance to Git. Git is not objectively better than Subversion. It's different. The key difference is that it is decentralized. With Subversion, you have a problem here: The SVN Repository may be in a location you can't reach (behind a VPN, intranet - etc), you cannot commit. If you want to make a copy of your code, you have to literally copy/paste it. With Git, you do not have this problem. Your local copy is a repository, and you can commit to it and get all benefits of source control. When you regain connectivity to the main repository, you can commit against it. Another thing for consideration is that Git tracks content rather than files. Branches are lightweight and merging is easy, and I mean really easy. It's distributed, basically every repository is a branch. It's much easier to develop concurrently and collaboratively than with Subversion, in my opinion. It also makes offline development possible. It doesn't impose any workflow, as seen on the above linked website, there are many workflows possible with Git. A Subversion-style workflow is easily mimicked.
Both solutions are decent, however, I had team members who had the experience working with HCL AppScan. Also, the product was priced nominally which suited our budget. Further, HCL AppScan's user community was bigger and many learning resources were freely available which helped junior peers learn quickly and eliminate any issues
Git has saved our organization countless hours having to manually trace code to a breaking change or manage conflicting changes. It has no equal when it comes to scalability or manageability.
Git has allowed our engineering team to build code reviews into its workflow by preventing a developer from approving or merging in their own code; instead, all proposed changes are reviewed by another engineer to assess the impact of the code and whether or not it should be merged in first. This greatly reduces the likelihood of breaking changes getting into production.
Git has at times created some confusion among developers about what to do if they accidentally commit a change they decide later they want to roll back. There are multiple ways to address this problem and the best available option may not be obvious in all cases.
There are countless implementations to accomplish the same thing, and so many configurations are required.
Even if you test it finished and find no vulnerabilities, there is no point if you just get the error screen.
Until now, I was worried about vulnerabilities and security in software development, but I think it was good to find the vulnerability problem quickly with HCL AppScan.
