CASA security assessment for Android app

[jacekschibsted]

I'm required to make CASA security assessment for Android that accesses GoogleFit data.

I did the static scan I try to continue with the process described on PWC website but at some point instruction tells me to download newest `Fortify ScanCentral Client` from god knows where. Looks like its owned by a company named FreeText (formely microsomething), requires signing in and access to the tool (whid doesn't seem to be free).

So? Is it free or not?

Also, am I only one reluctant to send entire app repo to some third party?

[dionv]

Hello @jacekschibsted ,

As reference from a previous post, it seems that using the PWC website for assessment to finish the tier 2 assessment was free. But one user encountered the same concern you have with Fortify ScanCentral client as needed and seems does not come as free.

What can be recommended is you can check open-source static analysis tools like OWASP Mobile Security Testing Guide (MSTG), detekt, or MobSF. These might not provide the same level of coverage as Fortify but offer free alternatives.

In regards to being reluctant to send your entire app to some third party is pretty normal as many developers prioritize code security and privacy. As an alternative, look for some tools that offer static analysis without requiring full repository access. Look for solutions that scan compiled code (APK) or provide options for source code anonymization or you can try internal review, where if possible, consider conducting a static analysis within your organization using internal tools or expertise, reducing the need for external parties.