A Security Practices Evaluation Framework
Apply Security Tooling
Use security-focused verification tool support (e.g. static analysis, dynamic analysis, coverage analysis) during development and testing.
Description
Use security-focused verification tool support (e.g. static analysis, dynamic analysis, coverage analysis) during development and testing. Static analysis tools apply verification rules to program source code. Dynamic analysis tools apply verification rules to running programs. Fuzz testing is a security-specific form of dynamic analysis, focused on generating progam inputs that can cause program crashes. Coverage analyzers report on how much code is ‘covered’ by the execution of a set of tests. Combinations of static, dynamic, and coverage analysis tools support verification of software.
Practice Implementation Questions
- Are security tools used by the project?
- Are coverage analyzers used?
- Are static analysis tools used?
- Are dynamic analysis tools used?
- Are fuzzers used on components that accept data from untrusted sources (e.g. users, networks)?
- Are defects created for (true positive) warnings issued by the security tools?
- Are security tools incorporated into the release build process?
- Are security tools incorporated into the developer build process?
Keywords
automate, automated, automating, code analysis, coverage analysis, dynamic analysis, false positive, fuzz test, fuzzer, fuzzing, malicious code detection, scanner, static analysis, tool