EXPERT RESPONSE
Most code analysis tools are effective for only a narrow set of programming languages and development environments. The first thing to verify is that the tool you deploy internally is optimized for the language, compiler, and platform/container your team is using.
Once a set of tools are identified you should think hard about how the tool will integrate into your existing development process. Would the tool introduce an extra manual step in the build process or require developers to perform a separate task? If so, the tool might not be utilized to its fullest potential when timeframes are tight.
Other characteristics to understand about code analysis tools include the type of security problems the tool identifies and the tool's false-positive rate (i.e. how often a flagged issue isn't really a problem at all). A tool that can only flag a narrow set of issues or a tool that generates 1000 warnings for every true security problem may create a lot of work for the development team without providing much improvement in security.
Finally, you need to evaluate how the code analysis tool fits into the broader application security strategy for your organization. Code scanners are not silver bullet solutions. A code scanner alone cannot achieve any appreciable improvement in the security quality of your applications without a secure software development life cycle in place and development staff fully trained on application security issues.
|
