Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

7/28/2014
09:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

DHS-Funded 'SWAMP' Helps Scour Code For Bugs

Cloud-based platform offering free secure coding tools for developers in government, enterprises, academia, gaining commercial attention as well.

A US Department of Homeland Security-funded online portal that provides government agencies, enterprises, higher education, and independent developers a free platform for testing their code for security holes and vulnerabilities has quietly begun attracting commercial application security providers.

The so-called SWAMP (Software Assurance Marketplace) portal, which was developed under a $23.5 million DHS Science & Technology Directorate project aimed at helping developers more easily test their code for bugs that could be exploited by black-hat hackers, currently offers for free five open-source software assurance testing tools, as well as a cloud-based platform for running the software security scans and tests and aggregating the results. The static analysis testing tools are used to scour source code for bugs.

SWAMP, which is operated by security and software assurance experts from the University of Illinois-Champaign/Urbana, the University of Indiana, the University of Wisconsin-Madison, and the Morgridge Institute for Research in Madison, plans to open its doors to commercial software security services on the site so users can have an integrated platform for handling their secure coding tests.  

"There are several commercial providers who would like to participate in SWAMP," says Miron Livny, director and CTO of SWAMP. "Users could use SWAMP for [these services] if they reached a licensing agreement with the provider."

Veracode could be one of the first such commercial firms to join SWAMP. Chris Wysopal, CTO and co-founder of Veracode, says his company hopes to participate by offering its technology as an option for SWAMP users. While SWAMP offers static code analysis tools, Veracode could also provide its binary analysis service to its existing customers via the SWAMP portal, he says, as well as to new customers there.

"We don't see SWAMP as competitive, because it is really a marketplace where government agencies can be exposed to software assurance technologies to learn and select the best approaches for their needs," Wysopal tells us. "Veracode wants to participate as a technology available to SWAMP users so government agencies can see the strengths of our binary-analysis approach, which is different than the other technologies, which are source-code analysis-based."

SWAMP provides static analysis testing, which tests code without executing it. The goal of SWAMP is to provide a framework for developers to bring all of their various software assurance tools into one place, its organizers say. "The long-term vision is a network of software assurance facilities," says Livny, who is also a professor of computer sciences with the University of Wisconsin-Madison, chief technology officer with the Morgridge Institute, and director of the Center for High Throughput Computing.

"We are working on adding binary tools" in addition to the existing menu of static analysis tools on SWAMP, he says. SWAMP -- which first went live in February in a quiet launch -- last week unveiled a new, friendlier user interface.

Software vendors increasingly are under pressure to train developers to bake security into their code so that programs are less prone to security vulnerabilities that in turn are used to exploit victims. But smaller and more financially strapped organizations haven't always had the resources or know-how to test their software properly.

SWAMP hopes to bridge that gap."Can we make software assurance more effective and reduce the cost? That's our goal," says Livny.

SWAMP currently offers FindBugs, which finds Java bugs; PMD, which detects common programming flaws in Java, JavaScript, XML, and XSL applications; Cppcheck, which scans for bugs in the C and C++ languages; Clang Static Analyzer, which detects bugs in C, C++, and Objective-C programs; and GCC, a compiler for checking C and C++ code syntax.

There also are some 400 open-source software testing packages on SWAMP for secure coding tool developers to use in their tools. The portal offers a testing laboratory for tool developers, using the National Institute of Technology's Juliet Test Suite, which provides public domain software programs containing known vulnerabilities.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/29/2014 | 9:32:32 AM
Re: DHS-Funded 'SWAMP' Helps Scour Code For Bugs
Awareness of the tools is a good first step. Awareness that software assurance is a critical issue that needs to be addressed by all developers in companies large and small is the bigger challenge, to be sure.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2014 | 9:04:20 AM
Re: DHS-Funded 'SWAMP' Helps Scour Code For Bugs
So true. =) If the tools are free, easy to use online, all that's left is awareness about them. But I can see that still being an issue for smaller orgs/developers.
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
7/29/2014 | 9:00:15 AM
Re: DHS-Funded 'SWAMP' Helps Scour Code For Bugs
Maybe it will make secure coding more mainstream. One thing it will potentially do is eliminate excuses.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/29/2014 | 8:54:31 AM
Re: DHS-Funded 'SWAMP' Helps Scour Code For Bugs
Given the strong push to write more secure code, this project indeed seems important. What I also think is cool about it is that it's going to include commercial scanning services, so users don't have to jump from one platform to another to scan their code. They can do it all from one platform, from what this promises. Maybe it will make secure coding more mainstream. 
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
7/29/2014 | 8:35:14 AM
DHS-Funded 'SWAMP' Helps Scour Code For Bugs
This is an excellent service, especially for government agencies and small organizations who do not necessarily have the financial or human resouorces to help in the development of secure code. I understand that security has to be tightly integrated into any software development project, but the reality is that doing so requires resources that organizations do not always have. If more commercial providers participate in the effort, it becomes an even stronger platform for source code security testing. Hopefully, it will not lead to developer complacency, or carelessness by thinking that there is a safety net for developing poorly secured code. Ideally, they will have developed what they believe to be secure code, and this service will either prove it, or at the very least show them where the pitfalls are for future development efforts.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .