Improving software security with static automated code analysis in an industry setting

Abstract

SUMMARY Software security can be improved by identifying and correcting vulnerabilities. In order to reduce the cost of rework, vulnerabilities should be detected as early and efficiently as possible. Static automated code analysis is an approach for early detection. So far, only few empirical studies have been conducted in an industrial context to evaluate static automated code analysis. A case study was conducted to evaluate static code analysis in industry focusing on defect detection capability, deployment, and usage of static automated code analysis with a focus on software security. We identified that the tool was capable of detecting memory related vulnerabilities, but few vulnerabilities of other types. The deployment of the tool played an important role in its success as an early vulnerability detector, but also the developers perception of the tools merit. Classifying the warnings from the tool was harder for the developers than to correct them. The correction of false positives in some cases created new vulnerabilities in previously safe code. With regard to defect detection ability, we conclude that static code analysis is able to identify vulnerabilities in different categories. In terms of deployment, we conclude that the tool should be integrated with bug reporting systems, and developers need to share the responsibility for classifying and reporting warnings. With regard to tool usage by developers, we propose to use multiple persons (at least two) in classifying a warning. The same goes for making the decision of how to act based on the warning. Copyright © 2012 John Wiley & Sons, Ltd.

On the capability of static code analysis to detect security vulnerabilities

“…Several studies evaluated static code analysis tools using other test suites or case studies [19][20][21][22]. University of Hamburg in collaboration with the Siemens CERT [19] created a test suite consisting of injected vulnerabilities in otherwise clean code.…”

Action research as a model for industry-academia collaboration in the software engineering context

“…Earlier, the authors have already been involved in conducting security research with the company (cf. [1]). During Cycles 1 to 4 the first researcher's responsibility was to facilitate the risk analysis, while in Cycles 5 and 6 this responsibility was with practitioners, and the researcher acted as an active participant in the risk analysis.…”

A Systematic Literature Review on Secure Software Development using Feature Driven Development (FDD) Agile Model

“…Additionally, there is no specific security role inside FDD [66][67][68]. Of course there are many security methods that been applied in the real world [69][70][71][72][73][74][75][76][77][78][79][80], especially in Malaysia [80] and India [81].There is also discussion and much awareness among IT organizations regarding software security practices [82] and the human factors that could attribute to software security [83].However, there is no specific research regarding the integration of security and FDD.…”