5 Ways to Accelerate Standards Compliance with Static Code Analysis

Klocwork by Perforce © 2019 Perforce Software, Inc.
5 Ways to Improve Developer Output with Static Analysis
ROD COPE | CHIEF TECHNOLOGY OFFICER , PERFORCE SOCTWARE

klocwork.com2 | Klocwork by Perforce © 2019 Perforce Software, Inc.
What We’ll Cover
1
2
3
4
5
A brief History of Testing
What is Static Code Analysis
Why Static Code Analysis is Beneficial
Beyond the Scope of Static Code Analysis
Static Code Analysis Best Practices
6 Q&A

History of Testing
1970s and 1980s 1990s 2000s 2010s
• Debugging is the
same as testing
• All I need is
unit testing
• How did we
survive without
automated testing?
• DevOps is
awesome!

Risks and Challenges
Regardless of industry or product, all software developers
share the same risks and challenges. These include:
• Human errors
• Software issues
• Hardware issues
• Shorter time to release
• More complex software

Static Code Analysis Myths and Facts
Static Code Analysis Myths
Static code analysis is a glorified complier.
Static code analysis
for “junior” developers.
Testing is for QA,
not developers.
Static Code Analysis Facts
Unlike compilers, static code analysis find
deep inter-procedural and inter-module
issues across the entire codebase.
Static code analysis helps all developers
become more effective, with large sets of
checkers, knowledge of entire code base
(including legacy code), and rapid results.
Fixing errors before check-in/build is easier,
cheaper, and causes less rework.

How Static Code Analysis Works
Static Code analysis performs tests that developers don’t (or wont) write.
D I F F E R E N T T Y P E S O F A N A L Y S I SR E Q U R I E S S O U R C E C O D E
• Must be able to compile code.
• No changes to existing build flow.
• Analyzes each path of your code.
• Inter-procedural.
• Inter-file.

Examples of How Static Code Analysis Works
• Static code analysis is similar to a spell. For example:
• “he went to the store.” (DEFECT: “he” should be capitalized)
• “He went to the store.” (FIXED)
• However, static code analysis is more sophisticated. For example:
• “Sally purchased two baskets of fruit at the store.
When she got home she put the three baskets of fruit on the counter.”
(DEFECT: she only purchased two baskets of fruit)
• “Sally purchased two baskets of fruit at the store.
When she got home she put the two baskets of fruit on the counter.” (FIXED)

How Static Code Analysis Can Help
• Buffer Overflows: Security exploit or program crashes.
• Null Pointer Dereferences: Your program crashes.
• Memory Leaks: Processor runs out of memory and
locks up.
• Uninitialized Data Usage: Data injection.
• Platform/OS Specifics: Privilege escalation.
• Concurrency: Deadlock.
• Coding: Ensuring that the code matches the
guidelines.
• Security: Ensuring that the code free of common
vulnerabilities.
• Safety: Ensuring that the code minimizes the risk.
C O D E I S S U E S S T A N D A R D S C O M P L I A N C E

Traditional Testing Versus Static Code Analysis
• Tradition testing tools require reproduction of the
exact runtime conditions that caused the issue to
occur.
• Requires tests specifically tailored to the code.
• Time consuming process.
• Not always accurate and reliable.
• Static code analysis finds defects early, that aren’t
easily identified by manual code reviews.
• Comprehensive and reliable.
• Identifies coding errors and vulnerabilities before they
become and issue.

Why Static Code Analysis Helps

Static Code Analysis Identifies Defects Early in the Process
$139
$455 $977
$7,136
$14,103
Requirements Design Coding Testing MaintenanceTime Detected
Specification
Design
Code
Unit Test
System Test
UAT
Release
Lifecycle Stage
Development Unit Tests QA Testing Production
Time
1X 3X 5X 10X
100X
Requirements Architecture Construction System Test Post Release
CosttoFixCosttoFix
CosttoFix

Static Code Analysis Improved Productivity
• Increases development productivity.
• No test cases, stubs, or complex set up.
• Runs your code “as is”.
• Example productivity benefits:
• Lawrence Livermore: $200K savings on 360K LOC project.
• Harris: $60K in six months on 10-person pilot project.
• LMCO: 1 critical defect per developer per year gives ROI.
• ACCESS Co. : 20% bug reduction (C/C++, IoT).
• OpenSpan: Achieved CWE Top 25 compliance.

Static Code Analysis Ensures Quality and Safety
Boeing
The Boeing 787 Dreamliner
had a software bug which
caused “total loss of electrical
power” after 248 days.
Department of Corrections
A software error that
calculates prison sentences
caused more then 3,200 U.S.
prisoners to be released
roughly 49 days early.

Static Code Analysis Identifies Bugs
• NEST “smart” thermostat software update caused
complete battery drain, shutting off heat during January.
• Matt Rogers, NEST co-founder said, “the bug took a few
weeks to show up.”
• The bug affected 2.5 million smart thermostats in U.S. alone.

Beyond the Scope of Static Code Analysis

Where Static Code Analysis Can’t Help
• Verify runtime behavior.
• Static tools are what they
say — “static”.
• Code is not executed.
• Verify code matches design.
• Does not verify that behavior
is as expected.
• Can detect issues that leads
us to discover design flaws,
such as unreachable code.
• Prove whether or not a system
will work.
• Static code analysis results
are not accepted as final word
for safety-critical systems.
However, they do point us
in the right direction.

• May report defects that aren’t a problem.
• These are known as false positives.
• False positives are not something to be afraid of.
• Is this a problem?
• Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo. (POTENTIAL DEFECT: repeat words)
• This is actually grammatically correct: Bison from Buffalo, New York, who are intimidated by other
bison in Buffalo, NY also happen to intimidate other bison in Buffalo, NY.
Limitations of Static Code Analysis

Static Code Analysis Best Practices

#1. Use SCA to Check the Security of Your Code
SURVEY:
Out of 1700 developers, 80% of them incorrectly answered
key questions surrounding the protection of sensitive data.
Organizations can have difficulty
preventing attacks because of:
Lack of time.
Lack of focus.
Lack of proper tools.
Most breaches result from input
trust issues, such as:
Cross-site scripting.
SQL injection.
Unvalidated input.

SCA Found Heartbleed
S C A R E P O R T

#2. Use SCA to Enforce Industry and Coding Standards
• Significantly reduces the cost of compliance.
• Complements existing testing approaches.
• Enables automated and repeatable analysis.
• Enforces key industry standards. Including:
• DISA STIG
• CWE
• MISRA
• CERT
• SAMATE
• OWASP
• DO-178B
• FDA validation
• And more

#3. Integrate SCA and CI Into Your Development Process
• Continuous Integration:
• Continuous merging and testing of developer changes
into the mainline code.
• Test thosechanges to verify they work with other
changes.
• Test new code as it is completed to catch issues early.
• Benefits of CI:
• Improves quality and productivity:
• 90% increase in LOC output per programmer when
performing daily builds.
• 36% reduction in defect rate with integration/regression
testing at each check-in.
• Increases the benefits of an Agile software
development methodology.

SCA and CI

Keys to Successful CI
To work in a true CI environment, SCA tools must be designed to be:
A U T O M A T E D S C A L A B L E E F F I C I E N T R E L E V A N T
Support the most
important CI build
management systems.
Require minimal
resources and deploy
across multiple agents.
To reduce feedback time,
only analyse the affected
code.
Report on only the
information that is required
for the given context.

#4. Use SCA to Validate Legacy/OSS
Integrate Test
Open
Source
COTS Contractors
Legacy ISV
Your
Product $$$$
Cost to Fix
Defects

#5. Use SCA to Help Developers Improve Code Quality
• SCA is an Educational Tool:
• Common programmatic errors.
• Security vulnerabilities.
• Standards compliance.
ONCE A DEFECT IS REPORTED,UNDERSTAND WHY IT’S A DEFECT AND HOW TO FIX IT.

Summary
1
2
3
Use SCA to check the security of your code.
• Enables you to find vulnerabilities early.
Use SCA to enforce industry and coding standards.
• Reduces the cost of compliance.
Integrate SCA and CI into your development process.
• Makes analysis automated, fast, and scalable.
4
5
Use SCA to validate legacy code/OSS.
• Enables you to check entire code base before release.
Use SCA to help developers improve code quality.
• Features a built-in training tool on the desktop.

• Support for CI via continuous static code analysis (CSCA).
• Desktop on-the-fly analysis as well as traditional server analysis.
• Helps to ensure compliance with MISRA, OWASP, FDA, CWE, DISA, and other industry and coding standards.
• Hundreds of built-in checkers that go beyond just the industry standards.
• Unique analysis engine that detects a thorough and comprehensive range of defects.
• Widest compiler support.
• Custom checker studio for extensibility.
• Support for process certification (ISO 26262).
Klocwork Continuous Static Code Analysis

5 Ways to Accelerate Standards Compliance with Static Code Analysis

More Related Content

What's hot

Similar to 5 Ways to Accelerate Standards Compliance with Static Code Analysis

More from Perforce

Recently uploaded

5 Ways to Accelerate Standards Compliance with Static Code Analysis