Q

Code analysis: Which tool is right for you?

Code scanners are excellent application security tools. Expert Brad Arkin explains which features security professionals should consider when choosing a code analysis tool.

We're in the market for a code scanner or some sort of code analysis tool. What kinds of features should we look for?

Most code analysis tools are effective for only a narrow set of programming languages and development environments. The first thing to verify is that the tool you deploy internally is optimized for the language, compiler, and platform/container your team is using.

Once a set of tools are identified you should think hard about how the tool will integrate into your existing development process. Would the tool introduce an extra manual step in the build process or require developers to perform a separate task? If so, the tool might not be utilized to its fullest potential when timeframes are tight.

Other characteristics to understand about code analysis tools include the type of security problems the tool identifies and the tool's false-positive rate (i.e. how often a flagged issue isn't really a problem at all). A tool that can only flag a narrow set of issues or a tool that generates 1000 warnings for every true security problem may create a lot of work for the development team without providing much improvement in security.

Finally, you need to evaluate how the code analysis tool fits into the broader application security strategy for your organization. Code scanners are not silver bullet solutions. A code scanner alone cannot achieve any appreciable improvement in the security quality of your applications without a secure software development life cycle in place and development staff fully trained on application security issues.

This was first published in August 2006
This Content Component encountered an error

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchSOA

TheServerSide

SearchCloudApplications

SearchAWS

SearchBusinessAnalytics

SearchFinancialApplications

SearchHealthIT

Close