Home > Software Quality All-in-One Guides > Web application security -- How to prevent attacks > Prevention techniques for developers/designers > Source code analysis > Static analysis tool helps software engineers find bugs during builds
All-in-One Guides: Web application security -- How to prevent attacks:
EMAIL THIS
 START   TYPES OF ATTACKS   SECURITY REQUIREMENTS   DEVELOPER TECHNIQUES   TESTER TECHNIQUES   TOOLS & TECHNIQUES   
Prevention techniques for developers/designers


Source code analysis
<< PREVIOUS | NEXT >>: Eight reasons to do source code analysis on your...

Static analysis tool helps software engineers find bugs during builds

By Jennette Mullaney, Associate Editor
03 Sep 2008 | SearchSoftwareQuality.com

Software quality news and advice
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google

When Mentor Graphics Inc. decided to switch to an agile methodology, the company needed a source code analysis tool that fit its development methodology and its complex code base. Klocwork Insight, a static analysis tool, provided the right services and conformed to agile principles.

Klocwork [Insight's] static analysis takes the runtime burden away from engineering and QA. It identifies potential software quality issues before [the code] gets built and propagated.
Kevin Pendleton
Director of quality and support systems, Mentor Graphics Inc.

The tool handles Mentor Graphic's extensive amount of source code, including older legacy code and newer acquired code, said Kevin Pendleton, director of quality and support systems for Mentor Graphics. Integrating Klocwork at the engineering desktop level prevents bugs from getting into builds or the QA environment, he explained.

"Klocwork [Insight's] static analysis takes the runtime burden away from engineering and QA," Pendleton said. "It identifies potential software quality issues before [the code] gets built and propagated."

Engineers discover and correct bugs themselves
Mentor Graphics uses the database that Insight creates at each build "to refactor legacy code and to analyze acquired technology details of code, relationships, third-party components, and forward architecture," Pendleton said. Engineers are able to view their own code and correct mistakes on the spot, while the information is still fresh in their minds. According to Klocwork, this process "empowers" engineers.

Pendleton agrees with that claim. "Let's just say our first step was to integrate Klocwork builds at our mainline system build level -- that is after engineering makes their changes and we build a system or set of products," he said.

In that scenario, Klocwork captures the impact of changes, particularly how many of a certain class of defect was introduced.

"We can correct those," Pendleton said, "but it's already a little late." However, if engineers are able to see and fix their own code, they are able to preclude that defect from ever being seen by QA or customers.

More information on the benefits of static analysis
How static analysis can improve software security

Static Analysis as Part of the Code Review Process -- Chapter 3, Secure Programming with Static Analysis

Web application security testing basics

Before choosing Insight, Mentor Graphics had been using dynamic analysis "sporadically," Pendleton said. He found dynamic analysis "more intensive" to complete.

"Typically, it requires a different caliber of an engineer who can run through all aspects of a design flow exorcising code to get all the bugs," Pendleton said. "With static analysis, you don't have to do it at the runtime -- you do it at the build level. It's easier to adopt."

Transitioning to agile
Easy adoption was crucial in light of the fact that Mentor Graphics was switching to an agile methodology. Pendleton is impressed with Klocwork Insight's integration into an agile environment.

"From my perspective, it fits very well with an agile model," he said. "Part of an agile approach is to find errors early, thereby reducing downstream costs."

Mentor Graphics decided to employ the Scrum model, Pendleton said. "We don't just flip a switch," he said of the transition. "We have a mixed environment as we look to deploy Scrum across our enterprise."

Pendleton has "high hopes" for standardizing Klocwork Insight as part of an agile implementation. "I think it makes sense based on results we've seen -- it's absolutely in line with agile principles," he said.

The tool is easy to use and has increased the productivity of Mentor Graphic's engineers and the quality of their code, according to Pendleton.

"As we move forward with our agile implementation, I'm looking forward to seeing Klocwork be a required element of that process," he said.



Tags: Software security testing toolsAgile software developmentScrum software developmentSource code analysisWeb application security tools and servicesTesting toolsVIEW ALL TAGS

Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


<< PREVIOUS | NEXT >>: Eight reasons to do source code analysis on your...
VIEW ALL IN THIS CATEGORY


RELATED CONTENT
Software security testing tools
How to make your software tamperproof
How can I tell if my software security has been breached?
Lesser-known free software testing tools testers should try
Demo: Using WebGoat, a free software testing tool
Rich Internet applications security testing checklist
Finding cross-site scripting (XSS) application flaws checklist
Webgoat Tutorial
Retaking command of your hacked software
Identifying whether or not your site or software has been hacked
Selecting the best tool for stress and load testing

Agile software development
How to stop developer vs. tester, quality-killing blame game
Testers debate differences between waterfall, Agile test automation
Tasktop brings task management into the application lifecycle
Test-driven testing face-off: Waterfall vs. Agile
Accelerating Agile testing with computer assistance
Agile by the numbers: Survey finds more adoption, but age-old problems
STPCon: How SocialText uses Agile, wikis and remote developers
First takes on Boston SPIN with Damon Poole and STPCon
Boston SPIN: A small group's big ideas about agile development
Using automation to speed up software testing in Agile

Scrum software development
Test-driven testing face-off: Waterfall vs. Agile
Agile by the numbers: Survey finds more adoption, but age-old problems
Boston SPIN: A small group's big ideas about agile development
Accelerate your agile software testing
Danube's Dan Rawsthorne: Scrum teams and metrics
Agile development growing, but problems remain
Turning agile skeptics to believers at Blueprint Systems
How Covad made the switch to a distributed agile development process
Can traditional project management and agile development coexist?
How teams transition to agile development methodologies

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
penetration testing  (SearchSoftwareQuality.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary



Software Development Methods - Extreme Programming, Agile Programming, Scrum
About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
SEARCH 
TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Site Map




All Rights Reserved, Copyright 2006 - 2009, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts