Risk
2/13/2008
01:00 AM
50%
50%

The Truth Behind Code Analysis

A true code review involves both scanning and architectural risk analysis

Quick, which one of these statements is correct? Open source software is more secure than closed source. Proprietary software is more secure than open source.

The answer is neither one! Software is software, and security should play an essential role in every kind of software, not one flavor (crunchy organic granola) or another (mass produced waxy chocolate bars). And don’t get me started about “many eyeballs” or the economic reasons why proprietary software is likely to be better tested. In the end, I believe the big debate over whether open source is more or less secure is a red herring.

The real lesson behind all the hoo-hah is that both open source projects and gigantic proprietary software divisions can benefit from software security best practices. Remember the touchpoints? They’re useful in all kinds of software projects.

In March 2006, the U.S. Department of Homeland Security began sponsoring the scan project, an effort by Coverity and Stanford University to apply the Coverity code scanning engine to widely used open source projects looking for bugs. Lots of bugs have been uncovered and, more importantly, fixed. A flurry of recent tech press stories simultaneously declared a round of security victory and bemoaned defeat. So which is it?

First, the optimistic view. The code scanning battle is well under way, and we are winning! I am a big fan of code scanning and believe that use of static analysis tools should always be one of the basic security steps integrated into every SDLC.

There are a number of very good code scanning tools available commercially these days, including Coverity’s Prevent, Fortify’s Source Code Analysis, Klocwork, and Ounce Labs’s Ounce 5. These tools each have particular strengths, and we have used almost all of them in our code scanning work here at Cigital.

Open source projects like Coverity’s scan project, which sparked this article, and Fortify’s Java Open Review project are excellent examples of the way code scanning technology can be implemented in a way that can only help everybody. The FindBugs project is also worthy of mention, because it’s not only targeted at open source – it is open source.

Okay, now for the reality check. There are huge problems with the notion of declaring "security" after passing a code scan with an arbitrary tool and a random set of rules. Fortunately the code scanning vendors know this (well, at least their technical people do). Unfortunately, the press does not.

The most obvious issue is that security defects come in two flavors – implementation bugs found at the code level and architectural flaws found at the design level. Each of these accounts for roughly half of the defects in practice.

Code scanning tools can only find bugs. Can a code scanning tool determine that no user authentication was performed? How about whether or not a playback attack will work? (Just for the record, the answer is “no way” in both cases.)

Another obvious problem is that the list of rules enforced by a static analysis engine can never be complete. The idea of trying to write down a list of all possible security bugs that could ever occur in any language (and then cramming them into a code scanner) is just plain silly. The set is infinite. Still, using a list of known problems (even if it’s incomplete) is a great idea, so code scanners have their place in the software security toolkit.

In the end, passing a code review is an indicator. I liken it to taking a patient's temperature. It's great first start; it's easy to do; and it happens all the time – but it's not the world’s best diagnosis tool. If the "temperature" is way out of bounds, you should seek medical attention for your code. But you also can die of some injuries without ever running a temperature.

Architectural risk analysis (sometimes called ARA or "threat modeling") is, like code scanning, an essential software security best practice. ARA is useful for finding flaws. A reasonable approach to software security covers both bugs and flaws. We can't ignore the architecture.

To their credit, the good people at Coverity are very careful about how they position scan project results. They say things like, “Eleven diligent projects which had resolved all of the defects identified at Rung 1 are the first projects to be upgraded to Rung 2. Those projects are Amanda, NTP, OpenPAM, OpenVPN, Overdose, Perl, PHP, Postfix, Python, Samba, and TCL.”

No overblown security claims there, just reality – and some solid results. Good for them. I hope they keep it up.

If you’re interested in static analysis for security (and you should be), buy and read Secure Programming with Static Analysis by Brian Chess and Jacob West.

— Gary McGraw is CTO of Cigital Inc. Special to Dark Reading

  • Cigital Inc.
  • Coverity Inc.
  • Fortify Software Inc.
  • Klocwork Inc.
  • Ounce Labs

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    5 Security Technologies to Watch in 2017
    Emerging tools and services promise to make a difference this year. Are they on your company's list?
    Flash Poll
    New Best Practices for Secure App Development
    New Best Practices for Secure App Development
    The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
    Slideshows
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2013-7445
    Published: 2015-10-15
    The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

    CVE-2015-4948
    Published: 2015-10-15
    netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

    CVE-2015-5660
    Published: 2015-10-15
    Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

    CVE-2015-6003
    Published: 2015-10-15
    Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

    CVE-2015-6333
    Published: 2015-10-15
    Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

    Dark Reading Radio
    Archived Dark Reading Radio
    In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.