Deploying Static Application Security Testing on a Large Scale

By Achim D. Brucker.

Static Code Analysis (SCA), if used for finding vulnerabilities also called Static application Security Testing (SAST), is an important technique for detecting software vulnerabilities already at an early stage in the software development life-cycle. As such, SCA is adopted by an increasing number of software vendors.

The wide-spread introduction of SCA at a large software vendor, such as SAP, creates both technical as well as non-technical challenges. Technical challenges include high false positive and false negative rates. Examples of non-technical challenges are the insufficient security awareness among the developers and manages or the integration of SCA into a software development life-cycle that facilitates agile development. Moreover, software is not developed following a greenfield approach: SAP’s security standards need to be passed to suppliers and partners in the same manner as SAP’s customers begin to pass their security standards to SAP.

In this paper, we briefly present how the SAP’s Central Code Analysis Team introduced SCA at SAP and discuss open problems in using SCA both inside SAP as well as across the complete software production line, i.e., including suppliers and partners.

Further Reading:
This presentation is based on the following publication:
A. D. Brucker and U. Sodan, “Deploying static application security testing on a large scale,” in GI sicherheit 2014, Mar. 2014, vol. 228, pp. 91–101. Author copy: http://logicalhacking.com/publications/brucker.ea-sast-expierences-2014/

Please cite this work as follows:
A. D. Brucker, “Deploying static application security testing on a large scale,” presented at the GI sicherheit 2014, Vienna, Austria, Mar. 19, 2014. Author copy: http://logicalhacking.com/publications/talk-brucker.ea-sast-expierences-2014/

BibTeX
@Unpublished{ talk:brucker.ea:sast-expierences:2014,
  date              = {2014-03-19},
  title             = {Deploying Static Application Security Testing on a Large
                       Scale},
  language          = {USenglish},
  venue             = {Vienna, Austria},
  author            = {Achim D. Brucker},
  eventtitle        = {GI Sicherheit 2014},
  slideshare        = {32498660},
  slideshare_width  = {427},
  slideshare_height = {356},
  abstract          = {Static Code Analysis (SCA), if used for finding
                       vulnerabilities also called Static application Security
                       Testing (SAST), is an important technique for detecting
                       software vulnerabilities already at an early stage in the
                       software development life-cycle. As such, SCA is adopted by an
                       increasing number of software vendors.
                       
                       The wide-spread introduction of SCA at a large software
                       vendor, such as SAP, creates both technical as well as
                       non-technical challenges. Technical challenges include high
                       false positive and false negative rates. Examples of
                       non-technical challenges are the insufficient security
                       awareness among the developers and manages or the integration
                       of SCA into a software development life-cycle that facilitates
                       agile development. Moreover, software is not developed
                       following a greenfield approach: SAP's security standards need
                       to be passed to suppliers and partners in the same manner as
                       SAP's customers begin to pass their security standards to SAP.
                       
                       In this paper, we briefly present how the SAP's Central Code
                       Analysis Team introduced SCA at SAP and discuss open problems
                       in using SCA both inside SAP as well as across the complete
                       software production line, i.e., including suppliers and
                       partners.},
  note              = {Author copy: \url{http://logicalhacking.com/publications/talk-brucker.ea-sast-expierences-2014/}},
}