If you ask development teams what their primary goal is, the three most common answers will likely include:
So, how can teams review code to make sure that the three primary goals are met?
Code analysis is the easy answer to the question, but should it be static code analysis? What about dynamic code analysis? Or maybe both?
Let's examine how static and dynamic code analysis play an important role in development and how their differences help shape code.
Static code analysis examines code to identify issues within the logic and techniques. Dynamic code analysis involves running code and examining the outcome, which also entails testing possible execution paths of the code.
Even in the most rudimentary fashion, when development teams test the code, they're performing dynamic analysis. And when programmers review the code, they're performing static analysis. Regardless of which tools they use, developers and programmers are performing analysis that ultimately helps create better code.
Neither static code nor dynamic code by itself is the ideal option, which means that teams should optimize both. Development teams can't think of static and dynamic code analysis as alternatives. View them instead as complementary and symbiotic.
If, for some reason, a team decides it wants to omit static code analysis, that really means it plans to not review the code. Think of code review and static code analysis as related terms. Code review helps find code issues without committing to expensive and time-consuming dynamic tests. Static code analysis, done in a code-review context, is the first and most essential step in developing and maintaining good software.
Static code analysis, done in a code-review context, is the first and most essential step in developing and maintaining good software.
Most static code analysis is done with tools designed to evaluate the code and look for errors or non-recommended techniques and practices. Organizations who treat static code analysis as an element of code review will likely conduct formal code reviews first, then apply the static code analysis tools and finally review the results through the code review process of choice.
If an organization decides to first review the code with a programmer and mentor, they might consider using static code analysis first. This approach will likely catch at least 85% of code errors and save the expert valuable time in identifying them.
Static code analysis and review is particularly well-suited to rapid development and GitOps environments, where changes are often made to a single component. For example, if the software design properly isolated component behaviors, static analysis will catch most of the code errors.
Simply put, static analysis doesn't catch every code defect.
It is particularly limited when it comes to addressing issues in complex, multi-component applications. It also provides little to no value when you want to measure performance or test policies for scaling and/or load balancing. These limitations are where dynamic code analysis comes into play.
Just as development teams already use static code analysis routinely -- even if it's not formally mandated or managed -- they also use dynamic code analysis. Routine software testing and running software to verify a fix or validate the initial implementation are forms of dynamic code analysis.
So, it's not a matter of static code analysis vs. dynamic code analysis. Teams likely already use both. The question becomes how to use both effectively.
Static code analysis is best paired with code review. Dynamic code analysis is suited to some form of automated testing and test data generation.
Teams should focus dynamic code analysis first on the area where static analysis is likely to be ineffective, such as component performance, application performance, application logic, security validation and crossing component boundaries. For example, automated test data generation tools such as Redgate SQL Data Generator and DTM Data Generator (to name just a few) will simulate an application's operation at full load, validate all the logic paths and test whether these points could have security vulnerabilities. An organization may already use these tools, but it's important that they're testing the specific areas that static analysis is most likely to miss.
It's easy to automate performance and load testing with widely available tools and practices. Logic and security validation are more difficult to set up with any form of generated-data automated testing. Teams will need to emphasize test design and carefully choose data generation tools with specific, per-field value constraints to run tests that identify potential issues. On the security validation front, teams should extend test data range values beyond normal operation to ensure they won't create potential problem areas.
The static and dynamic code analysis debate is an indicator of a fault in many development strategies that look more at individual steps instead of the overall process. Both static and dynamic code analysis have important roles to play as part of an integrated development and deployment process. Without each other, neither are likely to serve you well.
Scanning code for vulnerabilities means different things to different people. Generally, an organization’s approach to security evolves as they mature.
Related links:However, It’s always important to remember that different security testing methodologies have advantages (or weaknesses) when attempting to identify different classes of vulnerabilities.
There are many types of security testing methodologies as well as tools in the market that help DevOps teams identify vulernabilities in their applications.
Let’s first understand what types are in use.
Organizations often begin their software security programs with “penetration tests” (pen tests) of their software.
Third-party pen tests satisfy regulatory requirements like PCI-DSS and do not require internal security expertise. The next step is to license a dynamic analysis (DAST) tool and run automated scans against an application.
Dynamic analysis tools test a running application to identify inputs and then feed (or “fuzz”) data to those inputs. Examples include SQL commands, long strings, negative numbers, and data that may not be expected in the field. Among other vulnerabilities, DAST tools are effective at identifying input validation and memory allocation issues.
Static Application Security Testing (SAST) tools do not need a running application and therefore are used earlier in the SDLC. These tools also require more security expertise to manage and interpret results.
SAST tools work by “modeling” an application to map control and data flows. Rules can be run against the model to identify a wide variety of security issues.
Static analysis tools are quite effective in identifying common vulnerabilities such as SQL Injection, Cross-Site Scripting, and Buffer Overflows. They are rather less useful for issues such as authentication and privilege escalation.
Interactive Application Security Testing (IAST) tools use instrumentation to identify security vulnerabilities during normal functional testing.
This fits better with rapid development methodologies like Agile as it integrates security testing into the development process.
OWASP lists “Using Components with Known Vulnerabilities” in 3rd party and open source components as one of the top 10 issues in web application security.
As open source adoption has increased (and thousands of new vulnerabilities are disclosed each year) the need to identify vulnerable components has become more critical.
Since tools like SAST and DAST are largely incapable of identifying these components or vulnerabilities, organizations have adopted Source Composition Analysis (SCA) tools, which scan code simply to identify open source components. The resulting list of components, or Software Bill of Material (SBoM), can then be mapped to a database of licenses and publicly disclosed security vulnerabilities to flag vulnerable components.
There’s no doubt that the methods listed above help DevOps teams in identifying vulnerabilities in their applications. However, there are challenges with using these tools:
Integrate security early in the development process
Vulnerability or security scanning is one of many security activities available to organizations. While scanning is a good exercise, it should not be an organization’s primary security activity.
Security scanners find vulnerabilities after they have been produced which is an inefficient method to build security into software.
Instead, potential threats and vulnerabilities should be identified before development begins, using security testing merely as a validation activity.
Mature organizations focus on prevention; helping developers by building security tasks into their requirements.
For instance, threat modeling examines an application’s technology stack, deployment environment, and architecture to identify likely attack vectors and controls that can be implemented to reduce risk. Traditionally, these exercises take senior security experts weeks to complete, and conflict with agile development efforts. However, automating threat modeling processes can help organizations identify threats faster, and ensure security.
About Security Compass
Security Compass, a leading provider of cybersecurity solutions, enables organizations to shift left and build secure applications by design, integrated directly with existing DevSecOps tools and workflows. Its flagship product, SD Elements, allows organizations to balance the need to accelerate software time-to-market while managing risk by automating significant portions of proactive manual processes for security and compliance. SD Elements is the world’s first Balanced Development Automation platform. Security Compass is the trusted solution provider to leading financial and technology organizations, the U.S. Department of Defense, government agencies, and renowned global brands across multiple industries. The company is headquartered in Toronto, with offices in the U.S. and India. For more information, please visit https://www.securitycompass.com/
127
0
0
All Comments (0)
Previous: What is a sheet metal part?
Related Articles
If you are interested in sending in a Guest Blogger Submission,welcome to write for us!
Comments