Myths and Facts About Static Application Security Testing Tools: An Action Research at Telenor Digital

Abstract

It is claimed that integrating agile and security in practice is challenging. There is the notion that security is a heavy process, requires expertise, and consumes developers' time. These contrast with the agile vision. Regardless of these challenges, it is important for organizations to address security within their agile processes since critical assets must be protected against attacks. One way is to integrate tools that could help to identify security weaknesses during implementation and suggest methods to refactor them. We used quantitative and qualitative approaches to investigate the efficiency of the tools and what they mean to the actual users (i.e. developers) at Telenor Digital. Our findings, although not surprising, show that several barriers exist both in terms of tool's performance and developers' perceptions. We suggest practical ways for improvement.

A Perception of the Practice of Software Security and Performance Verification

“…Additionally, it was possible to identify a set of conjectures related to security and performance verification based on the analysis of collected information. The conjectures serve as the basis for recommendations in security and performance verification, confirming findings presented in [25] [26]. The results from this study will, also, allow to identify possible technology gaps and challenges and provide feedback to software researchers regarding the alignment of their research with real problems [27].…”

“…Additionally, they provide some recommendations for practitioners and researchers towards software testing: the need for more precision on the definition of security needs, the improvement of developers' security knowledge, and the need for lightweight techniques suitable for practical use. From the same research group, Oyetoyan et al [26] present the findings of an action research highlighting the developers' perceptions on using security static analysis tools, also in Norway. Some of the findings are also similar to our results: the high effort to configure the tools, the high number of false positives, and unknown real tools' capability.…”

Static Analyzers and Potential Future Research Directions for Scala: An Overview

“…Programmers and developers work with very short deadlines and are most concerned about delivering functionalities rather than having application security as the primary objective. Hence most software designs forgoe code testing and verification during the development stages [1]. Software defects, or bugs, can cost companies significant amounts of money, especially when they lead to software failure [2].…”

Toward Validation of Textual Information Retrieval Techniques for Software Weaknesses

“…The richness of the framework has ensured its usefulness for both research and practice. To name a few of the application domains, the CWE framework has been used for security (compliance) assessments [8,9], risk analysis [1,6], quantitative trend analysis [22], data mining [13], static source code analysis [25], dissemination of fuzzing results [15], and last but not least, education and security awareness [16]. Also text mining applications have been common, although there are still gaps in the literature.…”