Success with Static Analysis for Security: Why Code Audits Fail

Static analysis for security has been such a hot topic lately that it seems the industry is starting to think of it as a silver bullet. The quest for application security has breathed new life into static analysis technologies, which until quite recently were primarily perceived as either frivolous beautification tools or burdensome big brother monitoring systems. Surprisingly, the underlying technology was not substantially modified to accommodate the issue of security; rather, the changes were more like a face lift. As a result, organizations using static analysis technology still encounter the same fundamental challenges in making it sustainable over time.

The secret to making static analysis technologies a productive analysis solution is to use them in the proper context. The adoption of this technology should be driven by a policy-based approach. This means establishing a policy that defines requirements, then enforcing that policy consistently - not only with automation to ensure that the required practices are sustained, but also with workflow, task management, and metrics that enable you to measure how well the policy is being implemented. In the context of policy, static analysis is elevated from a "nice-to-have" checker to a critical tool for ensuring that code meets the organization's expectations.

This paper explains why and how to apply static analysis tools in the context of a policy-based security process that not only prevents security vulnerabilities, but also focuses on SDLC productivity.

Vendor:: Parasoft Corporation
Posted:: Feb 8, 2021
Published:: Apr 1, 2009
Format:: PDF
Type:: White Paper

Already a Bitpipe member? Log in here

Download this White Paper!

Corporate Email Address:
You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

Please provide a Corporate Email Address.

This email address is already registered. Please log in.
First Name:
You forgot to provide your first name.
Last Name:
You forgot to provide your last name.
Company Name:
You forgot to provide a company name.
Job Title:
You forgot to provide a job title.
Seniority:
You forgot to select your seniority.
Job Function:
You forgot to select your job function.
# of employees:
You did not select the number of employees at your company.
Industry:
You did not select which industry you are in.
Sub-Industry:
You did not select which industry you are in.
Address 1:
You did not provide a full local address.
Address 2:
City/Town:
You did not provide a full local address.
Country:
You did not select the country you are from.
State/Province:

You did not provide a full local address.
Zip/Postal Code:
You did not provide a full local address.
Phone:
You forgot to provide a phone number.

This phone number format is not recognized. Please check the country and number.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.