Handling Software Security Risks

Hackers are tireless, innovative, motivated.  They are an unfortunate reality of the software and applications industry today.  From automotive to medical to consumer products and more.

The potential for their efforts to result in real risks and failures is well documented. If your software fails, people are going to hear about it.  It will cost your company time, money, reputation, etc.  And it goes without saying that you would not want to be the individual or team responsible for any of that. Klocwork can help you mitigate those risks, cost effectively.

Software Security Risks are Well Documented,

  1. Patriot missile specification called for aircraft speeds and was designed to work continuously for 14 hours
  2. In gulf war it was used continuously for 100 hours against missiles which have speeds up-to Mach 6.
  3. Iraqi missile escaped this system because of low precision and resulted in 28 deaths and 90 wounded
  4. On June 3, 1980, NORAD reported that US was under missile attack. This happened because of an incorrect signal being generated, this could have triggered Nuclear war between US and USSR
  5. Several cancer patients die due to overdose of radiation resulting from a race condition between concurrent tasks in Therac-25 software

An advanced powerful Static Code Analysis Tool can detect the real security vulnerabilities at the time of development.

Software Defects can be Dangerous

Possible World war 3 : In 1980, NORAD reported that the US was under missile attack. The problem was caused by a faulty circuit, a possibility the reporting software hadn’t taken into account. In 1983, a Soviet satellite reported incoming US missiles, but the officer in charge decided to follow his gut feeling that it was a false alarm and decided to do nothing.

Medical Devices: The Therac-25 medical radiation therapy device was involved in several cases where massive overdoses of radiation were administered to patients in 1985-87 due to software defect Many patients died due to overdoses.

“How do we improve code quality and how to improve code security: Easiest one is "Static Code analysis"”

What is Static Code analysis

Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules.

Why Static code analysis,

  • Can review source code methodically and find real defects in the code
  • Can follow Coding standards and RCA learning
  • Can find most common defects at desktop
  • 100% Code coverage
  • Manual Code review effectiveness goes up

Klocwork is an advanced static code analysis tool that can detect almost all the real coding vulnerabilities in the code.

Klocwork Introduction

Klocwork – Kilo lines Of Code Work

  • Klocwork is a static code analysis tool used to identify security, safety and reliability issues in C, C++, Java and C# code. The product includes numerous desktop plug-ins for developers, metrics and reporting.
  • Static Code Analysis on-the-fly, to identify issues at the earliest possible point
  • Continuous Integration to maximize scalability and performance for multiple concurrent analysis at a time
  • Application Security to prevent malicious attacks
  • Validation of Industrial standards to check the industry (CWE, CERT, OWASP, DISA-STIG, Misra, Autosar, CERT, etc..,) and internal coding guidelines
  • Reporting and Metrics to understand and prioritize issues across the entire team
  • Code Review to get teams working faster towards delivering the best code possible

Klocwork – Advanced 3rd Generation Static code analyser

It starts at the developer's desktop. It's here where code is written, tested, reviewed, and written again. Finding problems here, at the earliest possible point before the build, means less testing later on and fewer downstream impacts to cost and schedule.

Klocwork has direct plugin available for Visual Studio, Eclipse, Windriver, IntelliJIidea and Eclipse based IDEs*. Klocwork has its own IDE/GUI as well that can help developer to find and fix the possible vulnerabilities at the time of creation.

Advantages of Klocwork at desktop,

  • Improves coding practices
    1. Alerts the developer immediately when they enter a defect
    2. Provides entire path from “source to sink” of how the issue occurs
    3. Provide help on how to remedy
    4. Provides links to the specific coding standards that may be violated
    5. Allows you to edit and customize that advice with simple HTML editing.
    6. The key is that not only do we help the developer, by telling them immediately it is an excellent “teachable moment.”    
  • Finally, since the developer makes the fix immediately, your code base is never impacted.

These days, we are used to having a spell-checker that works away, in the background, as we work on within our document editors. It would now seem rather alien and rather inefficient to return to having to spell-check a document on a button press, only when we were finished writing it. The same applies for code writing and SCA.

This technology is only possible thanks to Klocwork’s ability to perform partial, incremental, connected builds.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards. Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for free Klocwork Trail, https://meteonic.com/contact-us or send a mail to support@meteonic.com