OWASP - User contributions [en]

Code Review and Static Analysis with tools

2009-04-08T21:05:55Z

Mware:

Chapter: [[Virginia_(Northern_Virginia)#OWASP_Washington_VA_Local_Chapter | OWASP NoVA]] >> [[Virginia_(Northern_Virginia)#Knowledge | Knowledge]]

== Static Analysis Curriculum ==

* For an introduction to the OWASP Static Analysis (SA) Track goals, objectives, and session roadmap, please see [http://www.owasp.org/index.php/Image:OWASP_NoVA_SA_Track_Final_20090408.ppt this presentation].

== Code Review and Static Analysis with tools ==

<UL>
<LI>What: [[Security_Code_Review_in_the_SDLC | Secure Code Review]]
<LI>Who: Performed by Security Analysts
<LI>Where it fits: [http://bsi-mm.com/ssf/ssdl/cr/ BSIMM Secure Code Review]
<LI>Cost: Scales with depth, threat facing application, and application size/complexity
</UL>

This article will answer the following questions about secure code review and use of static analysis tools:
<OL>
<LI>What are static analysis tools and how do I use them?
<LI>How do I select a static analysis tool?
<LI>How do I customize a static analysis tool?
<LI>How do I scale my assessment practices with secure code review?
</OL>

== Organizational ==
How do I scale my assessment practices with secure code review?<p>

Implementing a static analysis tool goes a long way to providing a force multiplier for organizations. The following presentation discusses a comprehensive set of steps organizations can undertake to successfully adopt such tools. The presentation discusses who should adopt the tool, what steps they should take, who they should involve, and how long/much it will cost.<br>

[[Media:Cigital_-_Fortify_Implementation_Preso.ppt|Implementing a Static Analysis Tool.ppt]]<br>

For those with existing assessment practices involving secure code review (whether or not those practices leverage tools) the question often becomes, "I can review an application, but how do I scale the practice to my entire organization without astronomic cost?" The following presentation addresses this question:

[[Maturing_Software_Assessment_Through_Static_Analysis | Maturing Assessment Through Static Analysis]]

== Customization ==
People who believe that the value of static analysis is predominantly within their core capabilities "out of the box" come up incredibly short. By customizing your chosen tool you can expect:

<UL>
<LI>Dramatically better accuracy (increased true positives, decreased false positives, and decreased false negatives)
<LI>Automated scanning for corporate security standards
<LI>Automated scanning for an organization's top problems
<LI>Visibility into adherence to (or inclusion of) sanctioned toolkits
</UL>

The following presentation was given at the NoVA chapter in '06 and discusses deployment and customization:

[[Media:OWASP_Adopting_a_Static_Analysis_Tool.ppt|Adopting a Static Analysis Tool]]

Warning: this presentation is old and gives examples using the now defunct "CodeAssure" from what was then SecureSoftware.

Knowledge

2009-04-08T21:04:58Z

Mware:

The Northern Virginia (NoVA) chapter is committed to compiling resources on interesting and valuable topic areas. We hope that this structure helps you access information pertinent to your tasks at hand as you move through a secure application development life cycle. Currently, our topic areas of focus include activities such as:

* Threat Modeling
* [[Code Review and Static Analysis with tools]]
* Penetration Testing and Dynamic Analysis tools
* Monitoring/Dynamic patching (WAFs)

Certain projects our members are involved in cross-cut these activities, providing value throughout. They include:

* ASVS

Knowledge

2009-04-08T20:40:41Z

Mware:

File:OWASP NoVA SA Track Final 20090408.ppt

2009-04-08T20:40:11Z

Mware: uploaded a new version of "Image:OWASP NoVA SA Track Final 20090408.ppt"

Overview of the goals, objectives, and roadmap for the OWASP NoVA Static Analysis Track

File:OWASP NoVA SA Track Final 20090408.ppt

2009-04-08T20:31:43Z

Mware: Overview of the goals, objectives, and roadmap for the OWASP NoVA Static Analysis Track

Overview of the goals, objectives, and roadmap for the OWASP NoVA Static Analysis Track