LOGIN | REGISTER NOW | SUBSCRIBE
 

Experts: Put Source Code Analysis in Build


By Jennifer deJong
Email    print   
December 12, 2007 —  (Page 1 of 2)
How do you convince an overworked developer to add another task to a long to-do list?

Source code analysis tool makers have sought to answer that question since they began selling software for finding security flaws a few years ago.

Recently, they have begun offering a new answer: Run the scan at build time instead of insisting developers do the job at their desktops. “The build server is a powerful place to be,” said Fortify chief scientist and co-founder Brian Chess. “You don’t want [developers] to tie up their personal workstations.” Incorporating source code analysis as part of nightly build helps eliminate issues that will surface later, added Ounce Labs senior vice president of product management Claudia Dent. And it makes the task “more palatable to the development team.”

Neither company—nor their competitors—suggested that running the scanners at build time is the sole solution for finding security flaws. All of them said security should be addressed at every stage of the development process. But the build time approach has gained attention as source code analysis tool makers contend with the fact that their offerings have not been well received by developers. The key objection, as reported earlier by SD Times, is that scans take too long and turn up too many false positives. Another barrier to adoption is that the art of secure coding is so new that most professional developers working today have not been trained in the practice, said IBM Watchfire director of security research Danny Allan.

IBM acquired Watchfire earlier this year. The company sells, among other offerings, a penetration testing tool, which assesses application security by simulating attacks a hacker might launch.

Chess raised the issue of running source code analysis at build time in “Secure Programming With Static Analysis,” a recently published book he co-authored with Jacob West (Addison-Wesley 2007). Dent is tackling the topic in a forthcoming white paper. And IBM also advanced the idea. In an October meeting with SD Times, IBM Rational program manager Ashok Reddy said source code analysis can be “cumbersome for developers.” So IBM is readying its Build Forge offering, for automating the build process, to work with the company’s source code analysis partners, including Fortify, Klocworks and Ounce Labs.




Pages 1 2 


Share this link: http://sdt.bz/31398
 
Most Read Latest News Blog Resources
Taking enterprise architecture to the business side
Startup Corso is bringing out a cloud-based planning platform that ties into business plans
Zeichick’s Take: Radio moves from analog waveforms to digital packets
Streaming radio highlights the need for streaming applications to be designed to take up as little bandwidth as possible
Appcelerator Acquires Cocoafish to Add Instant Mobile Cloud Capabilities to its Industry Leading Titanium Platform
Appcelerator Offers Messaging, Social, Location and Storage Mobile Cloud Services to All Mobile App Publishers
ComponentOne Releases a Collection of 40+ UI Widgets Powered by HTML5 and jQuery
ComponentOne has announced the 2012 release of Wijmo: a kit of UI widgets for HTML5 and jQuery development
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
Git changes how developers manage source code versions
At this year's Git Together, developers praise the platform's convenience and its ability to make source control easier. Changes for the future will focus on making it more Web 2.0-compatible by offering more on-demand repositories on GitHub Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
Are you at risk for burnout?
Burnout is a severe problem and it can strike at any time. Here's how to tell if you are nearing the edge.
02/09/2012 02:16 PM EST

Agility, mom, and apple pie
If we're to evaluate the state-of-the-art in software development, we should start with the values espoused in the Agile Manifesto.
02/07/2012 11:57 AM EST

RIM woos developers with free tablet
How do you get more apps ported to the BlackBerry PlayBook? By giving every developer a free tablet, of course!
02/04/2012 01:57 PM EST

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

 
Events calendar tab
Cloud Connect
2/13/2012 to 2/16/2012
Santa Clara
TechWeb

SPTechCon: The SharePoint Technology Conf.
2/26/2012 to 2/29/2012
San Francisco
BZ Media

RSA Conf.
2/27/2012 to 3/2/2012
San Francisco
RSA

IBM Pulse Conf.
3/4/2012 to 3/7/2012
Las Vegas
IBM Tivoli

Game Developer Conf.
3/5/2012 to 3/9/2012
San Francisco
TechWeb