With increased reliance on the Web and the growth in Web application-based attacks, Bill Gates' call for companies to strive for excellence in security engineering at all stages of development was timely, if not overdue. In an effort to share best practices for developing secure code, Microsoft released their Security Development Lifecycle (SDL). SDL subjects products to static and dynamic code analysis to test for technical and logical vulnerabilities, and determine if products can withstand malicious attacks. Let's look at the benefits of adding this process to your application security strategy.
Static analysis involves reviewing an application's source code without executing the application itself using automated tools that analyze what the code does during every potential program execution. This allows the programmers to create diagrammatic or graphical representations of the code, which gives them a better understanding of the executed code's effects. It is then necessary to have experienced developers analyze the results and examine any suspect source code to remove the coding errors. While program compilers only identify language rule violations, such as type violations and syntax errors, static analysis checks the source code for problems such as semantical errors that pass through compilers and result in problems such as buffer overruns, invalid pointer references, uninitialized variables and other vulnerabilities.
However, some problems are difficult to foresee during static analysis. Interaction of multiple functions can generate unanticipated errors, which only become apparent during component-level integration, system integration or deployment. Therefore, once the software is functionally complete, dynamic analysis should be performed. Dynamic analysis reveals how the application behaves when executed, and how it interacts with other processes and the operating system itself. While static analysis can find errors early in the development cycle, dynamic analysis tests the code in real-life attack scenarios.
Finding and fixing programming errors can be time consuming, but it is worth it. In fact, Gartner pegs the cost of removing security vulnerabilities during testing to be less than 2% of the cost of removing it from a production system. To help you streamline this process, there are numerous code analysis tools available -- many of which are free. There's a comprehensive list of tools, including metric and lint-like (tools that flag suspicious language usage) available at http://testingfaqs.org/t-static.html. If you use Microsoft's development environments, Microsoft offers several free code analysis tools, such as PREfix, PREfast and FxCop.
While including static and dynamic code analysis in an application security strategy can reduce the risk of vulnerabilities making it into the final version, the following can help you improve the overall quality and security of your applications as well:
- Develop and implement an application security lifecycle. Having an application security lifecycle in place can reduce the cost of eradicating vulnerabilities and make your efforts more effective. For example, Microsoft found that using their SDL has significantly reduced the rate of external discovery of security vulnerabilities.
- Move your security assessment phase into the development phase. Many developers have found that doing so actually reduces overall application development times.
- Repeat the security assessment process when the business logic in the application changes. This is necessary to evaluate the impacts of any changes on overall application security.
About the author:
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for SearchSecurity's Web Security School and, as a SearchSecurity.com site expert, answers user questions on application and platform security.
