SSivanesh Waran

Category: Uncategorized

Categories
Uncategorized

HKMC Secure Coding Guidelines

The HKMC Secure Coding Guidelines is a set of coding standards and best practices for developing secure software applications. It is developed and maintained by the Hong Kong Mortgage Corporation (HKMC) as a part of their security framework to ensure the confidentiality, integrity, and availability of their applications and data.

Meeting Compliance Needs While Managing Risk Effectively with Klocwork

The guidelines cover various topics such as input validation, authentication, authorization, session management, error handling, cryptography, and secure coding practices for specific programming languages such as C, C++, Java, etc..,. The guidelines are intended to be used by software developers, architects, and quality assurance professionals to help them build secure software applications that can withstand various forms of cyber-attacks.

The benefits of using the HKMC Secure Coding Guidelines include:

  • Improved security: The guidelines provide developers with best practices and standards for building secure applications that can help prevent security vulnerabilities such as buffer overflows, SQL injection, cross-site scripting, and other types of attacks.
  • Compliance: Adherence to the HKMC Secure Coding Guidelines can help ensure that software applications meet regulatory and industry security requirements and standards, such as ISO 27001 and OWASP.
  • Reduced risk: By using the guidelines to develop secure software, organizations can reduce the risk of data breaches, loss of confidential information, and reputational damage caused by security incidents.
  • Cost savings: Building secure applications from the ground up can be more cost-effective than fixing security vulnerabilities after the fact, which can be much more expensive and time-consuming.
  • Increased stakeholder trust: Adherence to the guidelines can help build stakeholder trust, as it demonstrates a commitment to security and protecting sensitive information.
  • Improved collaboration: By providing a common set of guidelines and best practices, the HKMC Secure Coding Guidelines can improve collaboration between developers, security professionals, and other stakeholders involved in the software development process.

The HKMC Secure Coding Guidelines can help organizations build secure software applications that are resilient to cyber attacks, compliant with regulatory and industry standards, and cost-effective to develop and maintain.

How to verify HKMC Secure Coding Guidelines

The HKMC Secure Coding Guidelines can be verified through a number of methods, including:

  • Code reviews: Conducting a code review can help identify any areas of the software application that may not adhere to the guidelines. This can be done manually or using automated tools.
  • Penetration testing: Conducting penetration testing can help identify any security vulnerabilities in the application that may not have been identified during the development process.
  • Compliance audits: Conducting compliance audits can help ensure that the software application meets regulatory and industry security requirements and standards, such as ISO 27001 and OWASP.
  • Training and awareness programs: Providing training and awareness programs to developers and other stakeholders can help ensure that they understand the guidelines and are able to follow them effectively.
  • Self-assessment tools: The HKMC Secure Coding Guidelines may also include self-assessment tools that can be used to assess the compliance of the software application against the guidelines.

It is important to note that verifying adherence to the guidelines is an ongoing process that should be integrated into the software development lifecycle. This can help ensure that the software application remains secure and compliant with changing security threats and regulations.

How to verify HKMC Secure Coding Guidelines with Klocwork – Static Code Analysis Tool

Klocwork is a static code analysis tool that can be used to verify compliance with the HKMC Secure Coding Guidelines. Here are the general steps you can follow:

  • Install Klocwork: First, you will need to install Klocwork and configure it to work with your software development environment.
  • Compile your source code: Next, you will need to compile your software application’s source code with Klocwork.
  • Configure the HKMC Secure Coding Guidelines: Klocwork includes built-in rulesets that can be used to check compliance with the HKMC Secure Coding Guidelines. You will need to configure Klocwork to use these rulesets.
  • Run the analysis: Once Klocwork is set up and configured, you can run the analysis on your software application’s source code.
  • Review the results: Klocwork will generate a report that lists any violations of the HKMC Secure Coding Guidelines. You should review these results and work with your development team to address any identified issues.
  • Verify fixes: After fixing any issues, you can run the analysis again to verify that the issues have been addressed and that the application now complies with the HKMC Secure Coding Guidelines.

It’s worth noting that Klocwork is just one tool that can be used to verify compliance with the HKMC Secure Coding Guidelines. Other static code analysis tools, such as Veracode and SonarQube, can also be used for this purpose. Additionally, manual code reviews and other forms of testing should be used in conjunction with automated tools to ensure comprehensive verification of compliance.

Klocwork is a well-known and widely used static code analysis tool that can help identify potential security vulnerabilities and other code quality issues in software applications. It includes built-in rulesets, such as the HKMC Secure Coding Guidelines, that can be used to check compliance with specific coding standards and best practices.

Klocwork uses a combination of data flow analysis, control flow analysis, and semantic analysis to identify potential issues in the source code. It can analyze a wide range of programming languages and can be customized to support specific coding standards or requirements. Overall, Klocwork is a powerful tool for identifying code quality issues and potential security vulnerabilities in software applications. Get your free trail copy of Klocwork from here.

Categories
Uncategorized

Klocwork – Advanced Static Code Analysis Tool

Klocwork is a static code analysis tool used in software development to detect and report potential security vulnerabilities, code defects, and quality issues early in the development process. It analyzes source code without executing it and identifies potential problems by analyzing the dataflow, structure, syntax, and logic of the code.

Klocwork is used by software developers and development teams to improve code quality, reduce the risk of security vulnerabilities and defects, and optimize software performance. Klocwork supports multiple programming languages including C, C++, C#, Java, JayaScript, Kotlin and Python, and integrates with various development environments and build systems. It also provides detailed reports and actionable insights to help developers understand and address potential issues in their code.

Klocwork demo. Register here to get started with the free trail version of Klocwork.

The benefits of using Klocwork in software development include:

  • Improved code quality: Klocwork helps identify and eliminate potential defects and vulnerabilities early in the development process, improving the overall quality of the code.
  • Increased productivity: By detecting issues before code is deployed, Klocwork helps developers save time and effort that would otherwise be spent debugging and fixing problems later in the development cycle.
  • Reduced risk: Klocwork helps mitigate the risk of security vulnerabilities and other critical issues that can lead to system failures or data breaches.
  • Compliance with industry standards: Klocwork provides support for various industry standards such as MISRA, Autosar, OWASP, CERT C/C++, PCI-DSS and CWE, helping developers ensure compliance with coding best practices and guidelines.
  • Better collaboration: Klocwork integrates with various development environments and tools, facilitating better collaboration among development teams, and making it easier to share knowledge and resolve issues.
  • Continuous improvement: Klocwork provides feedback on code quality and identifies potential areas for improvement, helping development teams to continuously improve the quality of their code.

Using Klocwork can help improve the efficiency, reliability, and security of software development, while reducing costs and increasing customer satisfaction.

Klocwork can detect various categories of defects in software code, including:

  • Security vulnerabilities: Klocwork can detect potential security vulnerabilities such as buffer overflows, SQL injection, cross-site scripting (XSS), and authentication issues.
  • Memory management issues: Klocwork can detect potential memory management issues such as memory leaks, null pointer dereferences, and dangling pointers.
  • Concurrency issues: Klocwork can detect potential concurrency issues such as race conditions, deadlock, and thread safety violations.
  • Coding standards violations: Klocwork can detect violations of coding standards and best practices such as naming conventions, indentation, and formatting.
  • Complexity issues: Klocwork can detect potential complexity issues such as long methods, high cyclomatic complexity, and nested loops.
  • Performance issues: Klocwork can detect potential performance issues such as inefficient algorithms, unnecessary memory allocation, and excessive I/O operations.
  • Error handling issues: Klocwork can detect potential error handling issues such as ignored error codes, unhandled exceptions, and incorrect use of return values.

Klocwork can help detect a wide range of potential defects and vulnerabilities in software code, enabling developers to improve the quality, security, and performance of their applications.

Some of the unique features of Klocwork include:

SmartRank technology: Klocwork uses SmartRank technology to prioritize and categorize detected issues based on their severity, frequency, and potential impact, helping developers focus on the most critical issues first.

Cross-project analysis: Klocwork can analyze multiple projects and codebases simultaneously, providing a holistic view of code quality and potential issues across the entire organization.

Customizable checkers: Klocwork allows developers to create and customize checkers to meet their specific needs, enabling them to address unique coding standards or security requirements.

Data flow analysis: Klocwork uses data flow analysis to detect potential security vulnerabilities and other issues related to the flow of data within the code, helping to ensure that sensitive data is protected and properly managed.

Incremental analysis: Klocwork can perform incremental analysis, meaning it only analyzes changes made to code since the last analysis, reducing analysis time and enabling faster feedback on code changes.

Integration with development tools: Klocwork integrates with various development tools, including IDEs, build systems, and code repositories, allowing developers to easily incorporate static code analysis into their existing workflows.

Like above Klocwork offers a range of powerful features that can help developers improve code quality, reduce the risk of security vulnerabilities, and optimize software performance.

Adopting Klocwork in a DevOps environment can be relatively easy, depending on the specific setup and requirements of the organization. Here are some factors that can affect the ease of adopting Klocwork in a DevOps environment:

Integration with existing tools: Klocwork integrates with various development tools, including IDEs, build systems, and code repositories. If the organization is already using these tools, integrating Klocwork can be straightforward, as developers can continue to use their familiar workflows.

Automation and CI/CD pipelines: Klocwork can be integrated into automated build and deployment pipelines, enabling developers to perform static code analysis as part of the development process. This can help identify issues earlier and reduce the time required for manual testing and debugging.

Customization: Depending on the specific requirements of the organization, Klocwork may need to be customized to meet unique coding standards or security requirements. Klocwork documentaion and support team can be of use here.

Overall, adopting Klocwork in a DevOps environment can be relatively easy, particularly if the organization is already using compatible development tools and has a strong culture of automation and continuous improvement.

Register here to get a free trail of Klocwork.

Categories
Uncategorized

What is MEMORY LEAK:

A memory leak is any part of an application that consumes memory without eventually releasing it. A condition caused by a program that fails to release the extra memory it allocates.

In programming languages like C/C++, the programmer can dynamically allocate additional memory to hold data and variables that are needed now but will not be used later in the program. The programmer must remember to deallocate those memory areas when they are no longer required. When you failed to deallocate the memory which you have allocated dynamically leads to MEMORY LEAKAGE.

Significance of Memory Leak

An application that consumes more memory without releasing any will eventually deplete the server’s memory pool. When an application repeatedly fails to return allocated memory that it has obtained for temporary use, it causes a gradual loss of available memory. As a result, the application’s available memory is depleted, and the application can no longer function.

So, memory leaks are a serious problem for applications that run continuously (servers), because even a small memory leak can cause the application to crash. Failed to deallocate the memory which is no longer needed can exhaust the amount of available memory, which in turn reduces the performance of the application as well as system.

How To Avoid Memory Leak :

  • Every malloc or calloc should have the following free function:

>> It’s a good idea to include a free function after each malloc (or calloc) function. Assume you need to create an array of characters in an application to store some dynamic data. Because we know that to create a dynamic array in C programming, we use the memory management function (malloc or calloc).

>> It is a good practise to write the free function immediately after the malloc or calloc. It avoids the situation in which the developer forgets to write the free function. Using free() function, we can deallocate the allocated memory.

                                SYNTAX ::

                              void free(void *ptr);

   Frees the allocated memory which has been created by malloc(), calloc() or realloc() functions.

   Freeing an already freed block or any other block, would lead to UNDEFINED BEHAVIOUR

   Freeing NULL pointer has no effect.

Vulnerable code example ::

/* Function with memory leak */

#include <stdlib.h>

void func()

{

int *ptr = (int *) malloc(sizeof(int));

ptr = NULL; /* Assigned NULL address to ptr */

free(ptr); /* Freeing the NULL ptr, but WE ARE NOT FREEING THE ALLOCATED MEMORY  leads to memory leak */

                return;

}

If free is not called after dynamic memory allocation when memory is no longer needed, will lead to memory leakage. In this case Klocwork reports a Memory Leak vulnerability as below,

Memory leak. Dynamic memory stored in ‘ptr’ allocated through function ‘malloc’ at line 5 is lost at line 6

  * sample.c:5: Dynamic memory stored in ‘ptr’ is allocated by calling function ‘malloc’.

  * sample.c:6: Dynamic memory stored in ‘ptr’ is lost.

These kind of issues at complex code also can be detected by Klocwork at the time of development itself which will help developer to write a better code.

Fixed code example

/* Function without memory leak */

#include <stdlib.h>

void func()

{

int *ptr = (int *) malloc(sizeof(int));

free(ptr); /* Freeing the ptr */

ptr = NULL; /* Assign the NULL to ptr */

return;

}

About Klocwork

Klocwork is an ISO, IEC certified static source code analysis tool from Perforce and widely adopted by more than 2,200 customers worldwide, allows developers to identify code defects, at developer’s desktop, while they are coding.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards.

Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for Klocwork Trail, or send a mail to siva@meteonic.com

Categories
Uncategorized

Handling Software Security Risks

Hackers are tireless, innovative, motivated.  They are an unfortunate reality of the software and applications industry today.  From automotive to medical to consumer products and more.

The potential for their efforts to result in real risks and failures is well documented. If your software fails, people are going to hear about it.  It will cost your company time, money, reputation, etc.  And it goes without saying that you would not want to be the individual or team responsible for any of that. Klocwork can help you mitigate those risks, cost effectively.

Software Security Vulnerability attacks

Software Security Risks are Well Documented,

  • Patriot missile specification called for aircraft speeds and was designed to work continuously for 14 hours
  • In gulf war it was used continuously for 100 hours against missiles which have speeds up-to Mach 6.
  • Iraqi missile escaped this system because of low precision and resulted in 28 deaths and 90 wounded
  • On June 3, 1980, NORAD reported that US was under missile attack. This happened because of an incorrect signal being generated, this could have triggered Nuclear war between US and USSR
  • Several cancer patients die due to overdose of radiation resulting from a race condition between concurrent tasks in Therac-25 software

An advanced powerful Static Code Analysis Tool can detect the real security vulnerabilities at the time of development.

Software Defects can be Dangerous

Possible World war 3 : In 1980, NORAD reported that the US was under missile attack. The problem was caused by a faulty circuit, a possibility the reporting software hadn’t taken into account. In 1983, a Soviet satellite reported incoming US missiles, but the officer in charge decided to follow his gut feeling that it was a false alarm and decided to do nothing.

Medical Devices: The Therac-25 medical radiation therapy device was involved in several cases where massive overdoses of radiation were administered to patients in 1985-87 due to software defect Many patients died due to overdoses.

“How do we improve code quality and how to improve code security: Easiest one is “Static Code analysis“”

What is Static Code analysis

Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules.

Why Static code analysis,

  • Can review source code methodically and find real defects in the code
  • Can follow Coding standards and RCA learning
  • Can find most common defects at desktop
  • 100% Code coverage
  • Manual Code review effectiveness goes up

Klocwork is an advanced static code analysis tool that can detect almost all the real coding vulnerabilities in the code.

Klocwork Introduction

Klocwork – Kilo lines Of Code Work

  • Klocwork is a static code analysis tool used to identify security, safety and reliability issues in C, C++, Java and C# code. The product includes numerous desktop plug-ins for developers, metrics and reporting.
  • Static Code Analysis on-the-fly, to identify issues at the earliest possible point
  • Continuous Integration to maximize scalability and performance for multiple concurrent analysis at a time
  • Application Security to prevent malicious attacks
  • Validation of Industrial standards to check the industry (Misra, Autosar, CERT, etc..,) and internal coding guidelines
  • Reporting and Metrics to understand and prioritize issues across the entire team
  • Code Review to get teams working faster towards delivering the best code possible

Klocwork – Advanced 3rd Generation Static code analyser

It starts at the developer’s desktop. It’s here where code is written, tested, reviewed, and written again. Finding problems here, at the earliest possible point before the build, means less testing later on and fewer downstream impacts to cost and schedule.

Klocwork has direct plugin available for Visual Studio, Eclipse, Windriver, IntelliJIidea and Eclipse based IDEs*. Klocwork has its own IDE/GUI as well that can help developer to find and fix the possible vulnerabilities at the time of creation.

Evaluation of Static Code Analysis – Klocwork is compatible to be used as any generation Static Code Analysis Tool .

Advantages of Klocwork at desktop,

  • Improves coding practices
    • Alerts the developer immediately when they enter a defect
    • Provides entire path from “source to sink” of how the issue occurs
    • Provide help on how to remedy
    • Provides links to the specific coding standards that may be violated
    • Allows you to edit and customize that advice with simple HTML editing.
    • The key is that not only do we help the developer, by telling them immediately it is an excellent “teachable moment.”    
  • Finally, since the developer makes the fix immediately, your code base is never impacted.
What not to do in this modern world

These days, we are used to having a spell-checker that works away, in the background, as we work on within our document editors. It would now seem rather alien and rather inefficient to return to having to spell-check a document on a button press, only when we were finished writing it. The same applies for code writing and SCA.

This technology is only possible with Klocwork – Static Code Analysis Tool. Thanks to Klocwork’s ability to perform partial, incremental, connected builds.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards. Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for Klocwork Trail, https://meteonic.com/contact-us or send a mail to support@meteonic.com

Categories
Uncategorized

Static Code Analysis in an Agile World

To keep pace with ever-increasing customer demands on software functionality and time-to-market expectations, software developers have had to evolve the way they develop code to be both faster and higher quality. As part of this trend, the Waterfall method of software development began to give way in the late 1990s to a more lightweight method of software development: Agile.

And as the use of Agile has continued to grow in the last decade, it continues to mature as well. Software organizations are constantly looking for ways to improve their Agile environments and minimizing software bugs is one area of focus. This paper will demonstrate that several of the core principles of Agile cannot be fully realized without implementing a repeatable process for ensuring code that is as bug-free as possible.

The approach recommended in this paper is the use of automated static code analysis (SCA) technology to locate and describe areas of weakness in software source code, such as security vulnerabilities, logic errors, implementation defects, concurrency violations, rare boundary conditions, or any number of other types of problem causing code.

Agile development — A brief history

Simply put, Agile software development is an approach that provides flexibility to accommodate continuous change throughout the software development cycle. It stresses rapid delivery of working software, empowerment of developers, and emphasizes collaboration between developers and the rest of the team, including business people.

Agile contrasts with the still-popular Waterfall development approach, which is front-end loaded with comprehensive scope and requirements definitions, and which employs clear, consecutive hand-offs from requirements definition to design to coding and then to quality assurance. In contrast, Agile incorporates a continuous stream of requirements gathering that flows throughout the development process. Business people

are involved throughout the release cycle, ensuring that the software being developed meets the true needs of both the end-user and the business. Change to the requirements and to the overall feature set is expected to occur as outside opportunities or threats arise.

In short, Agile fully embraces change and Agile teams are structured in such a way that they can receive and act on constant feedback provided by the build process, by other developers, from QA, and from business stakeholders.

Agile is based upon a number of guiding principles that all Agile teams follow. For the purposes of this discussion, four principles — or values — are of particular interest:

  • Quality software development
  • Iterative flexibility
  • Continuous improvement
  • Collaboration and communication

Quality software development

The primary focus of Agile development is to enable the development of quality software that satisfies a customer need — i.e. provides a functioning feature or capability — within a specific period of time (typically no more than a few weeks) called an “iteration” or “sprint” in a Scrum.

Iterative flexibility

With a focus on speed and nimbleness, Agile is open to changes that inevitably arise throughout the development cycle. The iterative process is flexible, based on an understanding that original requirements may (or will likely) need to change due to customer demand, market conditions, or other reasons. Because business users are involved throughout the process, and because each iteration is short, new requirements can be introduced and prioritized very quickly.

Continuous improvement

An Agile environment provides developers with an opportunity to learn new skills and to exercise greater autonomy to do their jobs. The iterative framework is empowering because it enables continuous improvement, with testing/quality assurance occurring as part of the iterative process, rather than only periodically or at the end of a long process when it is often difficult or not cost effective to fix coding defects or to incorporate lessons learned along the way. Agile also makes the testing and QA process transparent to the developers who originate the code, further contributing to their learning and facilitating future improvements and coding efficiencies.

Collaboration and communication

Communication and collaboration is critical in software development in general, but in an Agile development environment, it’s paramount. In fact, the Agile Manifesto (widely recognized as the de facto definition of Agile) emphasizes individuals and interactions as a key concept. Ultimately, its open communication and collaboration that facilities efficiencies in the development process. Having access to the right individuals, data, and feedback when needed allows the team to deliver working software in short iterations, as the Agile process demands.

Klocwork for Agile development

Powered by a comprehensive static analysis engine, Klocwork helps developers increase their agility and development velocity. The key principles of Agile development are supported in the following ways:

  • On-the-fly desktop analysis
  • Klocwork Plugins for IDE
  • Software metrics and reporting
  • Integration with CI/CD

On-the-fly desktop analysis

Klocwork desktop analysis is like spell-check for developers, giving instant, accurate, and continuous feedback on security vulnerabilities and critical defects being introduced into code, as its being written. Highlighting critical coding issues within the developer’s IDE the instant they’re created makes fixing defects part of the natural development workflow and ensures the most secure and reliable code is created before check-in. This approach reduces both the number of problems reported downstream in the dev cycle and the time developers need to spend going back and fixing those issues. This boost in productivity is important in an Agile environment.

Klocwork Desktop – Sample report

On-the-fly desktop analysis allows developers to find and fix critical coding issues before code check-in from within their IDEs. This reduces the time developers have to spend going back and fixing issues not detected until late in the dev process.

Klocwork Plugins for IDE

Klocwork offers a variety of C/C++, C# and Java desktop solutions to help you detect and fix issues as early as possible in the development cycle. You have several options that you can use to run your analysis:

If you use one of our supported IDEs, you can run analysis directly from within your IDE. Currently, there is Klocwork Desktop Plug-ins available for Visual Studio, Eclipse and IntelliJ IDEA across multiple languages.

Klocwork integration with Visual Studio

If you prefer to work on the command line, kwcheck is a desktop analysis tool for C/C++ and Java developers using IDEs and text editors that aren’t supported by Klocwork in the form of an IDE plug-in.

Software metrics and reporting

Klocwork provides a robust suite of more than 100 objective and actionable product metrics, which are derived directly from your software code (Figure 4). With drag and drop reporting capabilities, development team managers can quickly and easily answer key questions about their organization’s software development process. For example, a key question for Agile is whether bugs are being found and fixed at the developer desktop, or whether they are leaking to the integration build. Klocwork automatically aggregates information about what is being found and fixed at the desktop even though it is never propagated into the source stream. This unique capability allows teams to better understand the bug reduction activity that is happening before code checkin, generating a bottom-up view of how well defect containment is working.

Klocwork sample report – Metric report

This — combined with custom ownership models that allow metrics to be organized by people, groups, geography, components, and any other attribute that works for your organization — allows teams early in an iteration to identify the areas of greatest risk within their code base.

Klocwork Integration with CI/CD

Klocwork’s Continuous Integration (CI) capability enables your organization to identify and communicate errors faster, without waiting for nightly builds. By identifying and communicating issues faster, developers can fix problematic code earlier.

Klocwork with Jenkins integration

As developers update and commit code, the CI build system picks up the changes and performs many small, incremental builds throughout the day. Instead of waiting for nightly builds, Klocwork CI analyzes the new code and notifies developers of problems right away.

CONCLUSION

The ubiquitous nature of software today, coupled with the pressure to rapidly develop market-ready features and products in just weeks, has led to two related phenomena:

• The widespread adoption of Agile software development principles

• The adoption of various tools by Agile teams designed to help streamline and de-risk development projects

SCA may be right for your Agile team, particularly if you are finding your process being impacted by quality issues or security vulnerabilities, non-Agile friendly processes, and hard to maintain code. Implementing source code analysis within your Agile environment does not have to be disruptive. You can start small and analyze only a small project or a portion of a project. Compare the results against a similar project where these tools were not used. You’ll undoubtedly find opportunities to save significant time and money by using SCA in your Agile development process.

Categories
Uncategorized

What is Static Code Analysis

Static code analysis (SCA) or Source code analysis is the process of analyzing the source code without executing or running it. Static Analysis can detect possible vulnerabilities in the source code by analyzing a set of code against a set (or multiple sets) of coding rules.

Here are some benefits of Static Code Analysis,

  1. faster project execution
  2. Better source code at check-in
  3. Less costly development cycles
  4. Shorter time-to-market

Syntax Analysis

Syntax Analysis Creates a lossless transformation of the source code by generating the “Abstract Syntax Tree”.

Syntax Analysis can be used to find Coding Style Issues and Simple Defects

  • Simple security defects (e.g. use of banned encryption API)
  • Simple coding style issues (e.g. no dynamic memory allocation)

Data Flow Analysis

Data Flow Analysis Can find program crashes across functions and files. Monitoring the lifecycle of data objects like Creation, Assignment, Usage, Deletion and Must be monitored across all paths in the Control Flow Graph such as Function calls, Compilation units, Etc.,

Complex Issue – need trace back ( Sample report of Klocwork – Static Code Analyzer)

Klocwork Report with Root Cause Analysis

Symbolic Logic Analysis

  • Define functional behavior between symbols
  • Don’t necessarily know what the values will be at runtime
  • Used to infer software behavior

Complex Issue – need trace back ( Sample Klocwork Report – Static Code Analyser)

Unvalidated integer value ‘size’ is received from ‘atoi’ at line 1474 and can be used to access an array through call to ‘rcs_change_text’ at line 1707.

Security vulnerabilities detection with Klocwork

Klocwork – Static Code Analyser

Klocwork is an ISO, IEC certified static source code analysis tool from Perforce and widely adopted by more than 2,200 customers worldwide, allows developers to identify code defects, at developer’s desktop, while they are coding.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards. Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for Klocwork Trail, https://meteonic.com/contact-us or send a mail to support@meteonic.com

Categories
Uncategorized

Why Static Code analysis

Static code analysis (SCA) or Source code analysis is the process of analyzing the source code without executing it. Static Analysis Tools can detect possible vulnerabilities in the source code.

Apart from detecting vulnerabilities in the source code, SCA includes work with project architecture.

Static Code Analysis,

  • Can review source code methodically
  • Can follow Coding standards and RCA learning
  • Can find most common defects at desktop before you even run code
  • Help to Understand complex code
  • 100% Code coverage
  • Manual Code review effectiveness shoots up
  • Reverse Engineering code becomes easy
  • You can focus on functionality in code review

How to select a Static Code Analysis Tool

How to select a Static Code Analysis Tool

What kind of coding defects can be captured by Static Code Analysis Tool?

Being an advanced Static Code Analysis tool Klocwork can detect and help developer to fix coding vulnerabilities that includes,

  • Attempt to use Memory after Free
  • Banned recommended APIs
  • Banned required APIs
  • Buffer overflow
  • C/C++ Warnings
  • COM defects
  • Calculated values never used
  • Concurrency
  • DNS spoofing
  • Hard-coded credentials
  • Ignored return values
  • Improper memory deallocation
  • Inappropriate iterator usage
  • Invalid Arithmetic Operations
  • Localized string
  • Lowest possible privilege
  • Memory leaks
  • Mismatched return types
  • Null pointer dereference
  • Parse warning defects
  • Pipe hijacking
  • Porting issues
  • Possible DLL hijacks
  • Print functions format
  • Registry manipulation
  • Resource handling issues
  • Scan functions format
  • Speculative execution issues
  • Strong type checkers
  • Suspicious code practices
  • Unnecessary or missing includes
  • Unreachable code
  • Unused local variables
  • Unvalidated user input
  • Use of uninitialized data
  • Weak encryption

Klocwork – Static Code Analyser

Klocwork is an ISO, IEC certified static source code analysis tool from Perforce and widely adopted by more than 2,200 customers worldwide, allows developers to identify code defects, at developer’s desktop, while they are coding.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards.

Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for Klocwork Trail, https://meteonic.com/contact-us or send a mail to support@meteonic.com

Categories
Uncategorized

What Does Meteonic Innovation Do

“Meteonic Innovation” takes care of end to end process automation and software tools consultation. Meteonic provides automation & Integrations solutions to simplify complex software development process across SDLC, help develop quality & secure code and all of that with reduced cycle times especially for Telecom, Automotive, Defence & Aerospace, Healthcare companies. Below are some of our offerings,

  1. Klocwork – SAST for C, C++, C#, and Java
    • Klocwork is an advanced Static code analyser to find out the critical vulnerabilities like Memory leak, Array overflow, Concurrency violation, Security and Reliability vulnerabilities in the source code.
    • Klocwork can be used to verify industry standard compliance like MISRA, Autosar, CERT, CWE, OWASP, DISA-STIG, etc..,
  1. Understand – Source code visualisation and analysis
    • Understand from SciTools is a static analysis tool for maintaining, measuring and visualizing code bases in the form of Dependency graphs, Butterfly Diagram, State Diagram Etc..,
    • Understand can help you in visualising the entire project and find out the actual code flow.
  1. Squish – The GUI Test Automation Tool for all kinds of cross-platform desktop, mobile, embedded and web applications.
    • Squish is the tool of choice for several thousand companies worldwide to automate the functional regression tests and system tests of their graphical user interface (GUIs) and human machine interfaces (HMIs). The Squish GUI testing tool, a 100% cross-platform tool, features.
    • Squish can work on all desktop, mobile, web and embedded platforms with Test script recording feature includes Powerful and reliable object identification and verifications.
  1. Neuralegion – AI-powered Application Security Testing
    • NeuraLegion is a high-tech company based in Tel-Aviv, Israel. We help companies secure web applications with AI powered application security testing that quickly uncovers security and business logic flaws in application.
    • With our innovative state of the art AIAST technology, even complex vulnerabilities are detected in modern applications that no other solution is able to find.
  1. WhiteSource – Open source security and license compliance management platform.
    • WhiteSource can help You Secure Your Open Source Components. WhiteSource is the only all-­in-one security, compliance, and reporting solution for managing open source components, and the only one that operates in real-­time, by automatically and continuously scanning dozens of open source repositories, and cross-­referencing this data directly against the open source components in your build.
    • WhiteSource helps you find optimal components, automatically alerts you about known security vulnerabilities, bugs, new versions, patches, and fixes in the components you’re using. It automates the creation and enforcement of your company’s licensing policies, and centralizes inter-­departmental communications and approval processes. It keeps detailed inventories and due diligence reports.
  1. Kiuwan – Kiuwan is a software as a service (SaaS) static program analysis multi-technology software for software analytics, quality and security measurement and management.
    • As a multi-technology tool, Kiuwan supports many programming languages, such as: ABAP, C, C++, C#, Objective-C, COBOL, Java, JavaServer Pages (JSP), JavaScript, JCL, PHP, PL/SQL, Transact-SQL, SQL, Visual Basic, Visual Basic .NET, RPG, SQL*Forms, Android or Hibernate.
    • Kiuwan Automatically scans your code to identify and remediate vulnerabilities. Compliant with the most stringent security standards, such as OWASP and CWE, Kiuwan Code Security covers all important languages and integrates with leading DevOps tools.
  1. Tiobe – Measure Your Software Code Quality. TIOBE checks more than 1056 million lines of software code for its customers world-wide, real-time, each day.
    1. Based on the ISO 25010 standard about software quality
    2. Measuring 350 standardized aspects automatically
    3. Result is a score between 100 (level A) and 0 (level F)
    4. Methodology is called TIOBE Quality Indicator
  • 8. Incredibuild – Shorten development cycle time by 90% or more
    1. “IncrediBuild” that can dramatically accelerate the performance of a full range of compilation tasks and development tools, shortening development time and speeding product delivery.
    2. IncrediBuild works by providing every workstation the ability to use idle CPU’s of other machines available across your local network or in the public cloud as though they reside on your local workstation, effectively transforming every workstation to become a super computer with hundreds of cores and gigs of memory.
  • 9. Squish COCO – Coco is a multi-language code coverage tool. Automatic source code instrumentation is used to measure test coverage of statements, branches and conditions.
    • No changes to the application are necessary.
    • Executing a test suite against an instrumented application produces data that can later be analyzed.
    • This analysis can be used to understand how much of the source code has been hit by tests, which additional tests need to be written, how the test coverage changed over time and more.

You can go ahead and have a check on our Tools offering from the following link: http://meteonic.com/solution.html

Register here for Demo or trial license, https://www.meteonic.com/contact-us or send a mail to support@meteonic.com