Code Reviews. James Walden Northern Kentucky University
|
|
- Marylou Wilkerson
- 5 years ago
- Views:
Transcription
1 Code Reviews James Walden Northern Kentucky University
2 Topics 1. Types of Reviews 2. Code Review Process 3. Checklists 4. Prioritizing Code to Review
3 Code Reviews Inspection of source code by one or more people who aren t the author of the code. Goal: Identify defects for later removal. People: Moderator, reviewers. Scope: Module or small set of classes. Time: 1-2 hours; <1kloc
4 Benefits of Code Reviews 1. Find defects sooner in the lifecycle. (IBM finds 82% of defects before testing.) 2. Find defects with less effort than testing. (IBM rev: 3.5 hrs/defect, test: hrs/defect.) 3. Find different defects than testing. (Can identify design and requirements problems too.) 4. Educate developers about security bugs. (Developers frequently make the same mistakes.)
5 PCI DSS b Obtain and review policies to confirm that all custom application code changes for web applications must be reviewed (using either manual or automated processes) as follows: ƒcode changes are reviewed by individuals other then the originating code author, and by individuals who are knowledgeable in code revie techniques and secure coding practices. ƒcode reviews ensure code is developed accordin to secure coding guidelines such as the Open Web Security Project Guide (see PCI DSS Requirement 6.5). ƒappropriate corrections are implemented prior to release. ƒcode review results are reviewed and approved by management prior to release.
6 Inspections Most formal process. Thorough coverage with separated roles. Use checklists to focus on specified goals. Collect metrics to track defects. Determine whether further inspections of revised software needed at end of meeting. Extensive documentation of effectiveness. One study found defects/kloc with inspections compared with 3 defects/kloc in informal walkthrough.
7 Roles in Reviews 1. Moderator 2. Reader Manages meeting; follows up on issues. Paraphrases code during meeting. Not the author. 3. Recorder 4. Author Records bugs discovered. Provides context for code; answers questions. Makes corrections after code review.
8 Walkthroughs Less formal process. Author leads meeting and describes code. Focus on author needs, not quality goals. No checklists used or metrics gathered. Quality varies widely. Walkthrough quality depends solely on author. Useful for educating developers about code, provide high level view of design and defects.
9 Code Review Process Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator
10 Planning Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator 1. Author initiates Planning once code ready. 2. A Moderator is assigned to inspection. 3. Author and Moderator assemble inspection pkg. 4. Moderator identifies other participants.
11 Preparation Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator 1. Reviewers examine inspection package. 2. Reviewers use checklists and analysis tools. 3. Reviewers mark bugs found.
12 Meeting Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator 1. Reader describes code in own words. 2. Reviewers comment and ask questions. 3. Recorder notes all potential bugs, suggestions. 4. Team appraises code at meeting conclusion.
13 Rework Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator Author addresses issues recorded at meeting.
14 Follow-up Planning Prep Meeting Rework Follow-up Author Moderator Everyone Everyone Author Author Moderator 1. Moderator meets with Author about rework. 2. Moderator verifies all changes made correctly. 3. Author checks in corrected code.
15 Formality Spectrum Review Planning Prep Meeting Rework Followup Inspection Yes Yes Yes Yes Yes Team Review Yes Yes Yes Yes No Walkthrough Yes No Yes Yes No Pair Programming Peer Deskcheck Ad Hoc Review Yes No Continuous Yes Yes No Yes Possibly Yes No No No Yes Yes No
16 1. Know your limits. Code Review Tips Typical review speed is lines/hour. Limit meeting length to 1-2 hours. 2. Know what bugs to look for. Checklists Static analysis tools 3. Use tools. Simple tools: grep, findstr Code viewers Static analysis tools 4. Require preparation before the meeting.
17 Checklists Security reviews should include checklists of common problems, including: 1. SQL injection 2. Cross-site scripting 3. Input validation bugs 4. Checking return values 5. Resource name canonicalization 6. Race conditions
18 Code Review Problems 1. Requires substantial expertise in area of programming and security to be effective. 2. Human readers are fallible and will miss mistakes. 3. Code reviews are slow. Unreviewed legacy code will take time to review.
19 Prioritizing Code If you can t review everything, review Code that runs with privileged mode. Code that listens on globally accessible sockets. Code that is accessible w/o authentication. Code with a history of vulnerabilities. Code that handles sensitive data. Complex code. Code that changes frequently.
20 Reviewing for SQL Injection
21 Ex: Zune infinite loop on 12/31/08 year = 1980; while (days > 365) { if (IsLeapYear(year)) { if (days > 366) { days -= 366; year += 1; } } else { days -= 365; year += 1; } }
22 Key Points Roles Moderator Reader Recorder Author Process Planning Preparation Meeting Re-work Followup
23 References 1. Brian Chess and Jacob West, Secure Programming with Static Analysis, Addison-Wesley, Michael Howard, A Process for Performing Security Code Reviews. IEEE Security & Privacy, July Eoin Keary et. al., OWASP Code Review Guide 1.1, de_review_project, Steve McConnell, Code Complete, 2/e, Microsoft Press, Gary McGraw, Software Security, Addison-Wesley, PCI Security Standards Council, PCI DSS Requirements and Security Assessment Procedures, v1.2, Karl Wiegers, Peer Reviews in Software, Addison- Wesley, 2002.
24 Static Analysis James Walden Northern Kentucky University
25 Topics 1. Why Static Analysis? 2. False Positives and Negatives 3. Static Analysis Internals 4. Using the Tools
26 What is Static Analysis? Static = without program execution Includes everything except testing. Usually used to refer to compiler type tools. Examples Static type checking Vulnerability detection tools Formal methods
27 Why Static Analysis? 1. Code reviews require substantial expertise in secure programming. 2. Human readers are fallible and will miss mistakes. 3. Code reviews are slow. Unreviewed legacy code will take time to review.
28 Assurance Verification Techniques Static Analysis Formal Verification Code Review Security Testing Penetration Testing Cost
29 False Negatives and Positives False Positives Tool reports bugs in code that aren t there. Complex control or data flow can confuse tools. False Negatives Tool fails to discover bugs that are there. Code complexity or lack of rules to check.
30 Mistakes False Negatives and Positives False Positives False Negatives Check Heuristics
31 Static Analyis Approaches 1. Standard compiler warnings and type checking. 2. Lexing source checkers that look for bad names like strcpy() and gets(). 3. Parsing source code checkers. 4. Parsing checkers with annotations. 5. Formal proof based program verification.
32 Static Analysis Internals Parser Model Builder Analysis Engine
33 Parser Convert programming language to AST. Must have a parser for each language that tool supports. Abstract Syntax Tree
34 Control Flow Graph if(a > b) nconsec = 0 s1 = gethexchar(a) s2 = gethexchar(b) return nconsec
35 Data Flow with SSA Source Code: if (bytesread < 8) { } tail = (byte) bytesread; SSA Form: if (bytesread 1 < 8) { } tail 2 = (byte) bytesread 1 ; tail 3 = φ(tail 1, tail 2 );
36 Taint Propagation Track flow of data from source to sink. Source: where data comes into program. Sink: function that consumes the data. Vulnerabilities reported if Data comes from an untrusted source. Data consumed by a dangerous sink. No function between source and sink makes the data safe.
37 Tainting SQL Injection Example $link = mysql_connect($db_host, $DB_USERNAME, $DB_PASSWORD) or die ("Couldn't connect: ". mysql_error()); Source mysql_select_db($db_database); $username = $_GET[ username ]; $password = $_GET[ password ]; $query = "select count(*) from users where username = '$username' and password = '$password'"; $result = mysql_query($query); Source Sink
38 Local vs. Global Analysis Local Analysis: Analysis of an individual function, a.k.a. intraprocedural analysis. Global Analysis: Follows control and data flow between functions, a.k.a. interprocedural analysis.
39 Rules Security knowledge base for tool. Identify data sources. Identify data sinks. Model behavior of validation functions. Check for dangerous configurations. Check control flow (i.e. every lock released.) Customize for process + project Check coding style is obeyed. Check for custom functions, standards.
40 Static Analysis Tools Simple search (lexing) tools Flawfinder ITS4 RATS Parsing Tools Coverity SAVE HP Fortify Source Code Analyzer IBM Rational AppScan Source Edition Klocwork Insight FindBugs splint
41 Using the Tools Who runs the tools? Developers Security team When do you run the tool? While code is being written (IDE integration) Before code check-in After each build After major milestones What do you do with the results? Support code review process. Support security metrics. Use to decide if project should be released.
42 Code Reviews Review Results Run Tool Review Code Update Rules Fix Bugs
43 Static Analysis Metrics Vulnerability density (vulns/kloc) Vulnerabilities divided by severity Critical, high, medium, low Vulnerability types Injection, XSS, race conditions, etc. Vulnerability dwell How long bug remains in code after detection. Audit coverage Percentage of code covered by reviews.
44 Evolution of a Single Project
45 Key Points Static Analysis Source code needed, but not execution. Fast, repeatable, objective analysis. Sources and Sinks Malicious input enters program via sources. Exploitation occurs at the sink. Mistakes False positives False negatives
46 References 1. Brian Chess and Jacob West, Secure Programming with Static Analysis, Addison- Wesley, Eoin Keary et. al., OWASP Code Review Guide 1.1, ASP_Code_Review_Project, Gary McGraw, Software Security, Addison- Wesley, PCI Security Standards Council, PCI DSS Requirements and Security Assessment Procedures, v1.2, Karl Wiegers, Peer Reviews in Software, Addison-Wesley, 2002.
Under the hood testing - Code Reviews - - Harshvardhan Parmar
Under the hood testing - Code Reviews - - Harshvardhan Parmar In the news September 2011 A leading bank s Database hacked (SQLi) June 2011 Sony hack exposes consumer passwords (SQLi) April 2011 Sony sites
More informationWeb Applications (Part 2) The Hackers New Target
Web Applications (Part 2) The Hackers New Target AppScan Source Edition Terence Chow Advisory Technical Consultant An IBM Rational IBM Software Proof of Technology Hacking 102: Integrating Web Application
More informationSecure Development Processes
Secure Development Processes SecAppDev2009 What s the problem? Writing secure software is tough Newcomers often are overwhelmed Fear of making mistakes can hinder Tend to delve into security superficially
More informationApplication Security through a Hacker s Eyes James Walden Northern Kentucky University
Application Security through a Hacker s Eyes James Walden Northern Kentucky University waldenj@nku.edu Why Do Hackers Target Web Apps? Attack Surface A system s attack surface consists of all of the ways
More informationSecure Programming Techniques
Secure Programming Techniques Meelis ROOS mroos@ut.ee Institute of Computer Science Tartu University spring 2014 Course outline Introduction General principles Code auditing C/C++ Web SQL Injection PHP
More informationThe Business Case for Security in the SDLC
The Business Case for Security in the SDLC Make Security Part of your Application Quality Program Otherwise, Development Teams Don t View it is Part of their Job The notion of application quality, which
More informationWanted: Students to participate in a user study
Wanted: Students to participate in a user study Requirements: Know how to use the Eclipse IDE Knowledge in Java development Knowledge of static analysis is not required, but it is a plus Time: 2-3 hours
More informationThe Need for Confluence
The Need for Confluence The Essential Role of Incident Response in Secure Software Development Why do security incidents occur? What is the root cause? Faulty software (more often than not) What is the
More informationAppScan Deployment APPLICATION SECURITY SERVICES. Colin Bell. Applications Security Senior Practice Manager
APPLICATION SECURITY SERVICES AppScan Deployment Colin Bell Applications Security Senior Practice Manager Copyright 2017 HCL Products & Platforms www.hcltech.com The Evolution of Devops 2001 - Continuous
More informationPearson Education 2005 Chapter 9 (Maciaszek - RASD 2/e) 2
MACIASZEK, L.A. (2005): Requirements Analysis and System Design, 2 nd ed. Addison Wesley, Harlow England, 504p. ISBN 0 321 20464 6 Chapter 9 Testing and Change Management Pearson Education Limited 2005
More informationExamining the Code. [Reading assignment: Chapter 6, pp ]
Examining the Code [Reading assignment: Chapter 6, pp. 91-104] Static white-box testing Static white-box testing is the process of carefully and methodically reviewing the software design, architecture,
More informationInjection. CSC 482/582: Computer Security Slide #1
Injection Slide #1 Topics 1. Injection Attacks 2. SQL Injection 3. Mitigating SQL Injection 4. XML Injection Slide #2 Injection Injection attacks trick an application into including unintended commands
More informationInspection Overview Massood Towhidnejad Computer & Software Engineering Dept. Embry-Riddle University
Inspection Overview Massood Towhidnejad Computer & Software Engineering Dept. Embry-Riddle University Inspection Is used to verify intellectual products by manually examining the developed product, a piece
More informationChapter 9 Quality and Change Management
MACIASZEK, L.A. (2007): Requirements Analysis and System Design, 3 rd ed. Addison Wesley, Harlow England ISBN 978-0-321-44036-5 Chapter 9 Quality and Change Management Pearson Education Limited 2007 Topics
More informationPearson Education 2007 Chapter 9 (RASD 3/e)
MACIASZEK, L.A. (2007): Requirements Analysis and System Design, 3 rd ed. Addison Wesley, Harlow England ISBN 978-0-321-44036-5 Chapter 9 Quality and Change Management Pearson Education Limited 2007 Topics
More informationKishin Fatnani. Founder & Director K-Secure. Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009
Securing Web Applications: Defense Mechanisms Kishin Fatnani Founder & Director K-Secure Workshop : Application Security: Latest Trends by Cert-In, 30 th Jan, 2009 1 Agenda Current scenario in Web Application
More information90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
More informationAnalysis Tool Project
Tool Overview The tool we chose to analyze was the Java static analysis tool FindBugs (http://findbugs.sourceforge.net/). FindBugs is A framework for writing static analyses Developed at the University
More informationDevelopment*Process*for*Secure* So2ware
Development*Process*for*Secure* So2ware Development Processes (Lecture outline) Emphasis on building secure software as opposed to building security software Major methodologies Microsoft's Security Development
More informationWeb 2.0, Consumerization, and Application Security
Web 2.0, Consumerization, and Application Security Chenxi Wang, Ph.D. Principal Analyst Forrester Research OWASP, New York City September 25, 2008 Today s enterprises face multitude of challenges Business-driven
More informationMetrics That Matter: Quantifying Software Security Risk
Metrics That Matter: Quantifying Software Security Risk Brian Chess Fortify Software 2300 Geng Road, Suite 102 Palo Alto, CA 94303 1-650-213-5600 brian@fortifysoftware.com Abstract Any endeavor worth pursuing
More informationSoftware defects and security
CS-4920: Lecture 5 Developing Secure Software Today s Outcomes Discuss the connection between defects and security Identify several types of defects Discuss the cost/schedule ramifications of defect reduction
More informationLarge Scale Generation of Complex and Faulty PHP Test Cases
Large Scale Generation of Complex and Faulty PHP Test Cases Bertrand STIVALET Elizabeth FONG ICST 2016 Chicago, IL, USA April 15th, 2016 http://samate.nist.gov Authors Bertrand STIVALET National Institute
More informationSecurity Analyses For The Lazy Superhero
#1 Security Analyses For The Lazy Superhero #2 One-Slide Summary We can statically detect buffer overruns in programs by modeling the space allocated for a buffer and the space used for a buffer. We cannot
More informationCSC 482/582: Computer Security. Cross-Site Security
Cross-Site Security 8chan xss via html 5 storage ex http://arstechnica.com/security/2015/09/serious- imgur-bug-exploited-to-execute-worm-like-attack-on- 8chan-users/ Topics 1. Same Origin Policy 2. Credential
More informationLarry Maccherone Carnegie Mellon CyLab
1 What do building construction and software engineering have in common? Larry Maccherone Manager of Software Assurance Initiatives CyLab - Carnegie Mellon 2 Creating secure software is like constructing
More informationBuilding Security Into Applications
Building Security Into Applications Cincinnati Chapter Meetings Marco Morana Chapter Lead Blue Ash, July 30 th 2008 Copyright 2008 The Foundation Permission is granted to copy, distribute and/or modify
More informationIntegrating Tools Into the SDLC
Integrating Tools Into the SDLC SecAppDev 2007 The problem Too many organizations have either: Failed to try software security tools at all Tried tools, but became overwhelmed Tools relegated to shelfware
More informationSecure Programming Lecture 13: Static Analysis
Secure Programming Lecture 13: Static Analysis David Aspinall 10th March 2014 Outline Overview Vulnerabilities and analysis Using static analysis Simple static analysis tasks Type checking Style checking
More informationVulnerabilities and analysis. Simple static analysis tasks Type checking Style checking
Outline Recap Secure Programming Lecture 13: Static Analysis David Aspinall 10th March 2014 Overview Vulnerabilities and analysis Using static analysis Simple static analysis tasks Type checking Style
More informationContinuously Discover and Eliminate Security Risk in Production Apps
White Paper Security Continuously Discover and Eliminate Security Risk in Production Apps Table of Contents page Continuously Discover and Eliminate Security Risk in Production Apps... 1 Continuous Application
More informationEffective Detection of SQL/XPath Injection Vulnerabilities in Web Services
SCC 2009 Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services Nuno Antunes, Nuno Laranjeiro,, Henrique Madeira {nmsa, cnl, mvieira, henrique}@dei.uc.pt CISUC Department of Informatics
More informationOWASP 5/07/09. The OWASP Foundation OWASP Static Analysis (SA) Track Session 1: Intro to Static Analysis
Static Analysis (SA) Track Session 1: Intro to Static Analysis Eric Dalci Cigital edalci at cigital dot com 5/07/09 Copyright The Foundation Permission is granted to copy, distribute and/or modify this
More informationCIT 380: Securing Computer Systems. Software Security
CIT 380: Securing Computer Systems Software Security Topics 1. The problem of software security 2. System security standards 3. Secure lifecycle 4. Buffer overflows 5. Integer overflows 6. Format string
More informationCERT C++ COMPLIANCE ENFORCEMENT
CERT C++ COMPLIANCE ENFORCEMENT AUTOMATED SOURCE CODE ANALYSIS TO MAINTAIN COMPLIANCE SIMPLIFY AND STREAMLINE CERT C++ COMPLIANCE The CERT C++ compliance module reports on dataflow problems, software defects,
More informationIs Your Web Application Really Secure? Ken Graf, Watchfire
Is Your Web Application Really Secure? Ken Graf, Watchfire What we will discuss today Pressures on the application lifecycle Why application security defects matter How to create hacker resistant business
More informationSoftware Engineering 2 A practical course in software engineering. Ekkart Kindler
Software Engineering 2 A practical course in software engineering Quality Management Main Message Planning phase Definition phase Design phase Implem. phase Acceptance phase Mainten. phase 3 1. Overview
More informationSecuring Software Applications Using Dynamic Dataflow Analysis. OWASP June 16, The OWASP Foundation
Securing Software Applications Using Dynamic Dataflow Analysis Steve Cook OWASP June 16, 2010 0 Southwest Research Institute scook@swri.org (210) 522-6322 Copyright The OWASP Foundation Permission is granted
More informationWHITE PAPER. 10 Reasons to Use Static Analysis for Embedded Software Development
WHITE PAPER 10 Reasons to Use Static Analysis for Embedded Software Development Overview Software is in everything. And in many embedded systems like flight control, medical devices, and powertrains, quality
More informationC1: Define Security Requirements
OWASP Top 10 Proactive Controls IEEE Top 10 Software Security Design Flaws OWASP Top 10 Vulnerabilities Mitigated OWASP Mobile Top 10 Vulnerabilities Mitigated C1: Define Security Requirements A security
More information01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED
01/02/2014 SECURITY ASSESSMENT METHODOLOGIES SENSEPOST 2014 ALL RIGHTS RESERVED Contents 1. Introduction 3 2. Security Testing Methodologies 3 2.1 Internet Footprint Assessment 4 2.2 Infrastructure Assessments
More informationAndrew Muller, Canberra Managing Director, Ionize, Canberra The challenges of Security Testing. Security Testing. Taming the Wild West
Andrew Muller, Canberra Managing Director, Ionize, Canberra The challenges of Security Testing Advancing Expertise in Security Testing Taming the Wild West Canberra, Australia 1 Who is this guy? Andrew
More informationAutomated Assessment Tools
Automated Assessment Tools Barton P. Miller Computer Sciences Department University of Wisconsin bart@cs.wisc.edu Elisa Heymann Computer Sciences Department University of Wisconsin & Universitat Autònoma
More informationKenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you
More informationSession 11: Security Policies 1
Developing Secure Software EECE 412 Session 21 What s cell phones, ATMs, air traffic control systems, emergency service systems, healthcare equipment, and PDAs have in common? Internet security incidents
More informationUnit Level Secure by Design Approach
Unit Level Secure by Design Approach Abstract Authors: Vasantharaju MS & Joshua Cajetan Rebelo Vasantharaju_MS@McAfee.com Joshua.Rebelo@Siemens.com With cyber-attacks on the rise and high-profile breaches
More informationTest Plan. Version Created
Test Plan Version 1.0 2008.10.24 Created 2008.10.14 Yahoo! Property View Rob Shaw Team Leader Jacob McDorman Project Leader Robert Read Technologist Brad Van Dyk Editor Table of Contents [1] Introduction...
More informationDeveloping Secure Software
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Developing Secure Software EECE 412 Session 21 Copyright 2004 Konstantin Beznosov T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A
More informationIntegrigy Consulting Overview
Integrigy Consulting Overview Database and Application Security Assessment, Compliance, and Design Services March 2016 mission critical applications mission critical security About Integrigy ERP Applications
More informationStandard Glossary of Terms used in Software Testing. Version 3.2. Foundation Extension - Usability Terms
Standard Glossary of Terms used in Software Testing Version 3.2 Foundation Extension - Usability Terms International Software Testing Qualifications Board Copyright Notice This document may be copied in
More information[ANALYSIS ASSIGNMENT 10]
2009 Pidgin Carlos Simões Higino Silva João Carlos Almeida Miguel Graça Oliveira [ANALYSIS ASSIGNMENT 10] INTRODUCTION The purpose of this project is to evaluate a testing tool chosen by the team and provide
More informationQuality Assurance & Standards
Quality Assurance & Standards PSD3 Nov 2013 1 Overview Quality Assurance (QA)» checking what we are producing QA standards» checking the checking 2 Further Reading Sommerville» 9 th Edition, Chap. 24»
More informationApplication Security Approach
Technical Approach Page 1 CONTENTS Section Page No. 1. Introduction 3 2. What is Application Security 7 3. Typical Approaches 9 4. Methodology 11 Page 2 1. INTRODUCTION Page 3 It is a Unsafe Cyber world..
More informationGaps in Static Analysis Tool Capabilities. Providing World-Class Services for World-Class Competitiveness
Gaps in Static Analysis Tool Capabilities 1 Overview Gaps in Static Analysis tools as identified during the evaluation of five (5) commercially available static analysis tools Collaborative effort between
More informationSoftware Testing. Software Testing
Software Testing Software Testing Error: mistake made by the programmer/ developer Fault: a incorrect piece of code/document (i.e., bug) Failure: result of a fault Goal of software testing: Cause failures
More informationMicrosoft SDL 한국마이크로소프트보안프로그램매니저김홍석부장. Security Development Lifecycle and Building Secure Applications
Release Conception Microsoft SDL Security Development Lifecycle and Building Secure Applications KRnet 2010 2010. 6. 22. 한국마이크로소프트보안프로그램매니저김홍석부장 Hongseok.Kim@microsoft.com Agenda Applications under Attack
More informationStatic Analysis of C++ Projects with CodeSonar
Static Analysis of C++ Projects with CodeSonar John Plaice, Senior Scientist, GrammaTech jplaice@grammatech.com 25 July 2017, Meetup C++ de Montréal Abstract Static program analysis consists of the analysis
More informationObjectives. Chapter 19. Verification vs. validation. Topics covered. Static and dynamic verification. The V&V process
Objectives Chapter 19 Verification and Validation Assuring that a software system meets a user s need are to introduce software verification and validation (V&V) and to discuss the distinction between
More informationSimple Overflow. #include <stdio.h> int main(void){ unsigned int num = 0xffffffff;
Simple Overflow 1 #include int main(void){ unsigned int num = 0xffffffff; printf("num is %d bits long\n", sizeof(num) * 8); printf("num = 0x%x\n", num); printf("num + 1 = 0x%x\n", num + 1); }
More informationSecurity Engineering for Software
Security Engineering for Software CS996 CISM Jia An Chen 03/31/04 Current State of Software Security Fundamental lack of planning for security Most security issues come to light only after completion of
More informationAutomated Assessment Tools
Automated Assessment Tools Barton P. Miller Computer Sciences Department University of Wisconsin bart@cs.wisc.edu Elisa Heymann Computer Sciences Department University of Wisconsin Universitat Autònoma
More informationEngineering Your Software For Attack
Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.
More informationWeb Application & Web Server Vulnerabilities Assessment Pankaj Sharma
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web Applications?
More informationBinary Static Analysis. Chris Wysopal, CTO and Co-founder March 7, 2012 Introduction to Computer Security - COMP 116
Binary Static Analysis Chris Wysopal, CTO and Co-founder March 7, 2012 Introduction to Computer Security - COMP 116 Bio Chris Wysopal, Veracode s CTO and Co- Founder, is responsible for the company s software
More informationCIT 480: Securing Computer Systems. Software Security
CIT 480: Securing Computer Systems Software Security Topics 1. The problem of software security 2. System security standards 3. Secure lifecycle 4. Buffer overflows 5. Integer overflows 6. Format string
More informationStatic and dynamic Testing
Static and dynamic Testing Static testing Requirements specification High-level design Formal specification Detailed design Program Prototype Dynamic testing Ian Sommerville 1995 Software Engineering,
More informationSecure Programming Lecture 13: Code Review and Static Analysis
Secure Programming Lecture 13: Code Review and Static Analysis David Aspinall 4th March 2016 Outline Overview Vulnerabilities and analysis Using static analysis Simple static analysis tasks Type checking
More informationObject-Oriented and Classical Software Engineering
Slide 6.1 Object-Oriented and Classical Software Engineering Seventh Edition, WCB/McGraw-Hill, 2007 Stephen R. Schach srs@vuse.vanderbilt.edu CHAPTER 6 Slide 6.2 TESTING 1 Overview Slide 6.3 Quality issues
More informationObject-Oriented and Classical Software Engineering
Slide 6.1 Object-Oriented and Classical Software Engineering Seventh Edition, WCB/McGraw-Hill, 2007 Stephen R. Schach srs@vuse.vanderbilt.edu CHAPTER 6 Slide 6.2 TESTING Overview Slide 6.3 Quality issues
More informationHP 2012 Cyber Security Risk Report Overview
HP 2012 Cyber Security Risk Report Overview September 2013 Paras Shah Software Security Assurance - Canada Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
More informationMobile Malfeasance. Exploring Dangerous Mobile Code. Jason Haddix, Director of Penetration Testing
Mobile Malfeasance Exploring Dangerous Mobile Code Jason Haddix, Director of Penetration Testing Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
More informationTexas Regional Infrastructure Security Conference (TRISC) Dan Cornell
Securing the SDLC: A Case Study Texas Regional Infrastructure Security Conference (TRISC) 2008 Dan Cornell April 22, 2008 Agenda Denim Group introduction and background The problem: Integrate security
More informationSecuring Web Applications. Architecture Alternatives. Web Application Security Roadmap. Defense in Depth. Defense in Depth
V User Terminal Key Secure Storage Personal Computers AntiVirus Certificate Mgmt Authority :::::: Multiplexor Securing Web Applications Jennifer L. Bayuk jennifer@bayuk.com www.bayuk.com 1 Mainframe Wireless
More informationSecurity Testing. John Slankas
Security Testing John Slankas jbslanka@ncsu.edu Course Slides adapted from OWASP Testing Guide v4 CSC 515 Software Security What is Security Testing? Validate security controls operate as expected What
More informationITT Technical Institute. CS420 Application Security Onsite Course SYLLABUS
ITT Technical Institute CS420 Application Security Onsite Course SYLLABUS Credit hours: 4 Contact/Instructional hours: 50 (30 Theory Hours, 20 Lab Hours) Prerequisite(s) and/or Corequisite(s): Prerequisites:
More informationVerification and Validation
Verification and Validation Assuring that a software system meets a user's needs Ian Sommerville 2000 Software Engineering, 6th edition. Chapter 19 Slide 1 Objectives To introduce software verification
More informationSecurity Communications and Awareness
Security Communications and Awareness elearning OVERVIEW Recent high-profile incidents underscore the need for security awareness training. In a world where your employees are frequently exposed to sophisticated
More informationTenable.io User Guide. Last Revised: November 03, 2017
Tenable.io User Guide Last Revised: November 03, 2017 Table of Contents Tenable.io User Guide 1 Getting Started with Tenable.io 10 Tenable.io Workflow 12 System Requirements 15 Scanners and Agents 16 Link
More informationCMSC 132: OBJECT-ORIENTED PROGRAMMING II
CMSC 132: OBJECT-ORIENTED PROGRAMMING II Program Testing Department of Computer Science University of Maryland, College Park Debugging Is Harder Than Coding! Debugging is twice as hard as writing the code
More informationSecurity Solutions. Overview. Business Needs
Security Solutions Overview Information security is not a one time event. The dynamic nature of computer networks mandates that examining and ensuring information security be a constant and vigilant effort.
More informationThree General Principles of QA. COMP 4004 Fall Notes Adapted from Dr. A. Williams
Three General Principles of QA COMP 4004 Fall 2008 Notes Adapted from Dr. A. Williams Software Quality Assurance Lec2 1 Three General Principles of QA Know what you are doing. Know what you should be doing.
More informationMy name is Jesus Abelarde and I am Lead Systems Security Engineer for the MITRE Corporation. I currently work on multiple engineering domains that
My name is Jesus Abelarde and I am Lead Systems Security Engineer for the MITRE Corporation. I currently work on multiple engineering domains that includes Cyber, Network, Software, Testing and Integration
More informationWHITEHAT SENTINEL PRODUCT FAMILY. WhiteHat Sentinel Product Family
WHITEHAT PRODUCT FAMILY WhiteHat Sentinel Product Family Combining technology with human intelligence to deliver the world's most powerful and accurate application security WhiteHat Sentinel is a software-as-a-service
More informationSample Exam. Certified Tester Foundation Level
Sample Exam Certified Tester Foundation Level Answer Table ASTQB Created - 2018 American Stware Testing Qualifications Board Copyright Notice This document may be copied in its entirety, or extracts made,
More informationWHITEHAT SECURITY. T.C. NIEDZIALKOWSKI Technical Evangelist. DECEMBER 2012
WHITEHAT SECURITY DECEMBER 2012 T.C. NIEDZIALKOWSKI Technical Evangelist tc@whitehatsec.com WhiteHat Security Company Overview Headquartered in Santa Clara, CA WhiteHat Sentinel SaaS end-to-end website
More informationChapter 10. Testing and Quality Assurance
Chapter 10 Testing and Quality Assurance Different styles of doing code review Human Reviewer Code Inspection with continuous integration infrastructure Pinger s testing set up Testing Related topics 1.
More informationStatic Analysis Techniques
oftware Design (F28SD2): Static Analysis Techniques 1 Software Design (F28SD2) Static Analysis Techniques Andrew Ireland School of Mathematical and Computer Science Heriot-Watt University Edinburgh oftware
More informationHacking 102 Integrating Web Application Security Testing into Development
Hacking 102 Integrating Web Application Security Testing into Development Greg Pedley - gpedley@au1.ibm.com Brett Wallace - bretwal@au1.ibm.com Denice Wong deniwong@au1.ibm.com An IBM Proof of Technology
More informationStatic Analysis methods and tools An industrial study. Pär Emanuelsson Ericsson AB and LiU Prof Ulf Nilsson LiU
Static Analysis methods and tools An industrial study Pär Emanuelsson Ericsson AB and LiU Prof Ulf Nilsson LiU Outline Why static analysis What is it Underlying technology Some tools (Coverity, KlocWork,
More informationATTACKING SYSTEM & WEB Desmond Alexander CISSP / GIAC/ GPEN CEO FORESEC
ATTACKING SYSTEM & WEB Desmond Alexander CISSP / GIAC/ GPEN CEO FORESEC AGENDA VULNERABILITIES OF WEB EXPLOIT METHODS COUNTERMEASURE About Me DIRECTOR OF FORESEC COUNTER TERRORIST ACTION TEAM RESEARCH
More informationHacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK
Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for
More informationCMPSC 497: Static Analysis
CMPSC 497: Static Analysis Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University Page 1 Our Goal In this course,
More informationShiftLeft. Real-World Runtime Protection Benchmarking
ShiftLeft Real-World Runtime Protection Benchmarking Table of Contents Executive Summary... 02 Testing Approach... 02 ShiftLeft Technology... 04 Test Application... 06 Results... 07 SQL injection exploits
More informationCS 424 Software Quality Assurance & Testing LECTURE 3 BASIC CONCEPTS OF SOFTWARE TESTING - I
LECTURE 3 BASIC CONCEPTS OF SOFTWARE TESTING - I WHAT IS SOFTWARE TESTING? Testing can find faults in the software but cannot prove that the software is error-free. OBJECTIVES OF SOFTWARE TESTING To test
More informationAutomating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
More informationImportant Points to Note
Important Points to Note All Participating colleges are requested to mute your telephone lines during the webinar session. Participants are requested to make note of questions / responses to questions,
More informationCPSC 444 Project Milestone III: Prototyping & Experiment Design Feb 6, 2018
CPSC 444 Project Milestone III: Prototyping & Experiment Design Feb 6, 2018 OVERVIEW... 2 SUMMARY OF MILESTONE III DELIVERABLES... 2 1. Blog Update #3 - Low-fidelity Prototyping & Cognitive Walkthrough,
More informationPrinciples of Software Construction: Objects, Design, and Concurrency (Part 2: Designing (Sub )Systems)
Principles of Software Construction: Objects, Design, and Concurrency (Part 2: Designing (Sub )Systems) More Analysis for Functional Correctness Jonathan Aldrich Charlie Garrod School of Computer Science
More informationApplications. Cloud. See voting example (DC Internet voting pilot) Select * from userinfo WHERE id = %%% (variable)
Software Security Requirements General Methodologies Hardware Firmware Software Protocols Procedure s Applications OS Cloud Attack Trees is one of the inside requirement 1. Attacks 2. Evaluation 3. Mitigation
More informationSDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
More information