Fortify ScanCentral DAST: how to scan customer Private Applications

A Fortify ScanCentral DAST scan of public sites can be achieved by directly connecting over internet.

A Fortify ScanCentral DAST scan of customer private sites can be achieved by using one of the following options:

1. Whitelist Fortify Hosted scan sensor(s) source IP address(es) (i.e. provided by Ops)
2. Fortify Connect (FC) - point-to-point proxy tunnel without exposing the target application through your firewall. The most commonly expected deployment/scan scenario is Cloud/Remote Mode as described below:
   1. Scenario 1: DAST/WebInspect Sensor Running in the Fortify Hosted environment (Cloud/Remote Mode)
      1. The diagram included below depicts a DAST/WebInspect Sensor Running in the cloud based Fortify Hosted environment (aka Cloud/Remote Mode). This assumes you have internal applications which need to be scanned, but the internal applications are not accessible from outside your internal network.
         The Fortify Connect (FC) Client is a pre-configured executable that runs behind your firewall; establishes a point-to-point proxy tunnel through the firewall and connects to the Fortify Connect Server running in the cloud. The pre-configured FC Client executable will be available for download via the “ScanCentral DAST > Fortify Connect” configuration tab after you configure FC in your Fortify Hosted environment.
          
      2. Working with Fortify Connect for private application scanning
         1. 
      3. Fortify Connect Client on Fortify ScanCentral DAST
         
         1. Note: the Fortify Connect Client is only officially supported on Linux
      4. Configuring and using Fortify Connect
         
         1. Note: only from step 2 to step 7
3. Locally hosted Fortify DAST Scan Sensor
   1. Docker image
   2. Kubernetes Helm Charts