In this white paper:
Static analysis tools for finding programming problems have been around for decades. The early generation tools are nowadays considered quite primitive.
These tools have more recently been superseded by advanced tools such as CodeSonar.
But how are they different? This paper compares the quality of results, the kinds of defects that primitive tools can't find, the user interfaces, and several other key differences.
For more GrammaTech white papers, click here.
INTRODUCTION: An uninitialized variable has an undefined value, often corresponding to the data that was already in the particular memory location that the variable is using. This can...
INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...
INTRODUCTION: Agile, Scrum and DevOps are hot topics in software development but are teams really achieving the goals of these new approaches? Management isn’t convinced, a recent...
INTRODUCTION: The ISA/IEC 62443 standard (formerly ISA 99) is a set of process standards for secure development of products in industrial automation and control. A list of popular...
Since C++11, WG21 (the ISO designation for the C++ Standards Committee) has been focusing on shipping a new standard every three years. The standard is comprised of two primary parts:...
INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...
The software supply chain is a growing concern in software development. Security, in particular, of third party software is a risk that needs to be evaluated and managed. Binary code...
INTRODUCTION: Static analysis tools ship with a default set of error checkers that cover the most common and important types of errors. However, projects often benefit from specific...
INTRODUCTION: The recent interest in the so called “software supply chain” highlights the growing importance of using and reusing existing software. Companies realize they need to buy...
INTRODUCTION: Code reviews (or inspections) are an effective way to reduce defects in software projects. In fact, defect removal rate can be as high as 75%, meaning two thirds of all...
INTRODUCTION: The most effective tool is one that reports a good number of true positives, without too many false negatives, without consuming too much compute...
INTRODUCTION: Advanced static analysis tools are popular because they have proven effective at finding serious programming defects. In contrast to traditional dynamic testing, the...
I sometimes describe our main commercial product, CodeSonar, as a “defect detection tool.” While this is a convenient shorthand, it ignores a lot of what CodeSonar attempts to...
6:05What is tainted data analysis? How can you leverage taint analysis to find anomalous or unstructured data that can be used by attackers to gain access or crash an application? The questions answered a
Taint checking? This isn't a trap, I promise. It sounds vulgar, but its etymology is perfectly reasonable, stemming from the notion that data that has been "tainted" by a...
INTRODUCTION: GrammaTech brought unique binary code analysis to the market in 2013. Before then, the only option for binary analysis was to ship your code to specialists who would...
I'm pleased to inform the masses of our new integration plugin designed to work with CodeSonar and Atlassian JIRA Server software. This plugin will allow companies to seamlessly add the...
