Hello Everybody,
I am excited to be part of the SATEC project. Please find below my initial
draft, I would like to know your comments:
Categories:
Syntactic level
Semantic level
Supported Languages
Supported vulnerabilities
Support for library scanning
Configuration
Interface
Integration support
Platform support
Reporting
Performance
Formal Method support
Regression support
Logging
License type
Documentation/Support
Maturity of products
Features:
Syntactic level
a. Analyze vulnerable syntax
b. Compliance to standards like -
https://www.securecoding.cert.org/confluence/display/seccode/CERT+Secure+Coding+Standards
c. Detection of unauthorized content (used for testing) like credit
card details
d. Minimising false negatives and false positives
Semantic level
a. Analyze the code flow
Supported Languages: Multi Language support
a. C, C++, Java, Perl, Python, JavaScript, CSS
Supported vulnerabilities
a. Types of vulnerabilities
b. Identify standard vulnerabilities like –
i.
https://www.owasp.org/index.php/Top_10_2010-Main,
ii.
Support for library scanning:
a. Support for scanning built-in libraries/binaries of language used
Configuration options:
a. Support for loading new vulnerability database
b. Specifying levels of severity to be scanned
c. Option to ignore some vulnerabilities
Interface
a. Command line
b. Intuitive GUI
Integration support:
a. Integration with existing IDE like Eclipse, NetBeans etc.
b. Integration with Version control system to identify issues during
Check-In process
c. Integration with issue/bug management system to raise issues
Platform Support
a. Operating System: Windows, Linux, Mac
b. Different hardware support: 32 bit, 64 bit processors
a. Support for HTML, text, XML based reports
b. Reports with severity of the issue
c. Email support for sending the reports
a. Scanning of number of lines of code per second
a. Use of formal methods identifying the vulnerabilities (
http://en.wikipedia.org/wiki/Formal_methods)
a. Run the tool in batch script and produce comparing with previous
testing
Logging: Good logging support
License type
a. Open source : GPL
b. Commercial
Documentation/Support
Maturity of products
References:
http://projects.webappsec.org/w/page/13246983/WAFEC-1-HTML-Version
http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
https://www.owasp.org/index.php/Source_Code_Analysis_Tools
https://www.owasp.org/index.php/Web_Application_Firewall
http://www.cert.org/secure-coding/tools.html
Regards,
Srikanth
On Sat, Jul 2, 2011 at 2:49 PM, Srikanth Ramu srikanthr@gmail.com wrote:
Hello Everybody,
I am excited to be part of the SATEC project. Please find below my initial
draft, I would like to know your comments:
Hi Srikanth,
Great work so far. Here is some of my initial input.
Features:
2. Semantic level
a. Analyze the code flow
It's important to directly address the specific types of external flow
sensitivity and slicing direction capabilities.
E.g. SAST Product A requires working data flow in order to analyze
control flow and allows data flow analysis from sources to sinks
SAST Product B works with data flow only but allows tracing
from both sources-to-sinks as well as sinks-to-sources
Supported Languages: Multi Language support
a. C, C++, Java, Perl, Python, JavaScript, CSS
It would also be nice to speak to the point that some products are
focused on specific verticals e.g. financial, medical, aviation,
mobile apps, embedded systems, OS kernels, etc
4. Supported vulnerabilities
a. Types of vulnerabilities
I think you should check out the NSA CSA paper on Static Analysis
Tools in order to gain insight into the vulnerability categories that
they use. It's also my opinion that we should probably use the
terminology "software weaknesses" instead of "vulnerabilities" or
"vulnerability categories" when talking about these products.
5. Support for library scanning:
a. Support for scanning built-in libraries/binaries of language used
It is extremely important to speak about the base class library
support for mapped sources-passthrus-sinks (source-sink database), in
addition to support for common frameworks and popular third-party
components.
I found a large list of third-party components here --
http://smartbear.com/products/qa-tools/automated-testing/survey/
Thank you Andre for the comments.
On Sat, Jul 2, 2011 at 3:41 PM, Andre Gironda andreg@gmail.com wrote:
On Sat, Jul 2, 2011 at 2:49 PM, Srikanth Ramu srikanthr@gmail.com wrote:
Hello Everybody,
I am excited to be part of the SATEC project. Please find below my
initial
draft, I would like to know your comments:
Hi Srikanth,
Great work so far. Here is some of my initial input.
Features:
Semantic level
a. Analyze the code flow
It's important to directly address the specific types of external flow
sensitivity and slicing direction capabilities.
E.g. SAST Product A requires working data flow in order to analyze
control flow and allows data flow analysis from sources to sinks
SAST Product B works with data flow only but allows tracing
from both sources-to-sinks as well as sinks-to-sources
Supported Languages: Multi Language support
a. C, C++, Java, Perl, Python, JavaScript, CSS
It would also be nice to speak to the point that some products are
focused on specific verticals e.g. financial, medical, aviation,
mobile apps, embedded systems, OS kernels, etc
Supported vulnerabilities
a. Types of vulnerabilities
I think you should check out the NSA CSA paper on Static Analysis
Tools in order to gain insight into the vulnerability categories that
they use. It's also my opinion that we should probably use the
terminology "software weaknesses" instead of "vulnerabilities" or
"vulnerability categories" when talking about these products.
Support for library scanning:
a. Support for scanning built-in libraries/binaries of language
used
It is extremely important to speak about the base class library
support for mapped sources-passthrus-sinks (source-sink database), in
addition to support for common frameworks and popular third-party
components.
I found a large list of third-party components here --
http://smartbear.com/products/qa-tools/automated-testing/survey/