AppDetective Software Renewal

EDCAPS is an integrated financial management system. EDCAPS comprises the following broad functional areas: the General Ledger, encompassing the preparation of financial statements, reconciliation of general ledger account balances with subsystems, sub ledgers, and Department of the Treasury; Funds Management to include budget execution and funds control; Grants Pre- & Post-Award, including grant processing, program payments and accounting; Contract Pre- & Post Award, executing contract award, purchasing and invoice processing functions; Receivables Management; Promissory Notes Processing; and finally, Administrative Processes, to include travel and administrative payments. EDCAPS is considered mission critical to the Department’s operations. AppDetectivePro is used to perform vulnerability scans and user access reviews of the EDCAPS Oracle database.AppDetectivePro for Oracle is a network-based, vulnerability assessment scanner that locates and assesses the security strength of

database applications within EDCAPS through penetration testing and security audit techniques. IT locates, examines, reports, and helps fix security holes and misconfigurations.AppDetectivePro is the product of choice of an overwhelming margin of corporate auditors, IT advisors, and Federal Government OIGs (including ED’s) as their database scanning and vulnerability assessment solution. AppDetectivePro leverages Application Security, Inc.’s SHATTER knowledgebase, the industry’s most complete collection of database vulnerability and misconfiguration checks to ensure the most comprehensive database assessment possible.The solution consists of three distinct functional modules:•Database Discovery – automatically finds all databases on the network.•Database Vulnerability Assessment – scanning engine identifies vulnerabilities and misconfigurationsincluding default or weak passwords, missing patches, poor access controls, and a host of otherconditions.•User Rights Review – provides a scan-based review of user entitlements that automaticallydetermines each user’s effective privileges.AppDetectivePro’s reporting system allows easy reporting of all database and application intelligence to appropriate stakeholders. Reporting options include: Inventory reports, Vulnerability Details and Summary reports, User Rights reports, Policy reports, and various others. Reports can be output in multiple formats including: PDF, Excel, Word, Crystal, HTML, XML and Text.No other software offers such a comprehensive list of features for this important function. In order to continue using and maintaining the AppDetectivePro software, we are required to purchase an annual subscription and maintenance. This annual maintenance entitles the Department to receive software updates, bug fixes, and support, should issues arise. Purchasing a new vulnerability scanning package rather than renewing our current maintenance does not make sense at this time. Only Trustwave, as the original software developer, can provide the required subscription and support. The support is available from multiple resellers, though, so competition is possible.