Evaluate Weigh the pros and cons of technologies, products and projects you are considering.

Code analysis: Which tool is right for you?

Code scanners are excellent application security tools. Expert Brad Arkin explains which features security professionals should consider when choosing a code analysis tool.

We're in the market for a code scanner or some sort of code analysis tool. What kinds of features should we look for?

Most code analysis tools are effective for only a narrow set of programming languages and development environments. The first thing to verify is that the tool you deploy internally is optimized for the language, compiler, and platform/container your team is using.

Once a set of tools are identified you should think hard about how the tool will integrate into your existing development process. Would the tool introduce an extra manual step in the build process or require developers to perform a separate task? If so, the tool might not be utilized to its fullest potential when timeframes are tight.

Other characteristics to understand about code analysis tools include the type of security problems the tool identifies and the tool's false-positive rate (i.e. how often a flagged issue isn't really a problem at all). A tool that can only flag a narrow set of issues or a tool that generates 1000 warnings for every true security problem may create a lot of work for the development team without providing much improvement in security.

Finally, you need to evaluate how the code analysis tool fits into the broader application security strategy for your organization. Code scanners are not silver bullet solutions. A code scanner alone cannot achieve any appreciable improvement in the security quality of your applications without a secure software development life cycle in place and development staff fully trained on application security issues.

Dig Deeper on Topics Archive

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.