Source code analysis sought by Pentagon’s U.S. Transportation Command

The Defense Department’s U.S. Transportation Command is requesting information from potential vendors who could perform a “source code analysis” – looking for security vulnerabilities such as cross-site scripting, injection flaws and malicious file executions – in eight different software programs used by the Command.

USTRANSCOM emphasized in a sources-sought notice published online on January 28 that it has not yet decided if it will issue a formal Request For Proposals (RFP).

It wants to hear from firms capable of undertaking a manual line-by-line review of its software, rather than using an automated methodology.

The selected vendor, if any, would be expected to “evaluate code for areas that may result in security threats,” said the notice, including, but not limited to:

• Cross-site scripting;
• Injection flaws;
• Malicious file execution;
• Insecure direct object reference;
• Cross-site request forgery; and
• Broken authentication and session management.

Interested prospective vendors are asked to submit white papers (to a maximum of five pages) outlining their capabilities by February 11. Further information is available from Andrea Mouser at andrea.mouser@ustranscom.mil or 618-256-9609.