Tainted Data Analysis in CodeSonar

INTRODUCTION: An uninitialized variable has an undefined value, often corresponding to the data that was already in the particular memory location that the variable is using. This can...

INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...

INTRODUCTION: Agile, Scrum and DevOps are hot topics in software development but are teams really achieving the goals of these new approaches? Management isn’t convinced, a recent...

INTRODUCTION: The ISA/IEC 62443 standard (formerly ISA 99) is a set of process standards for secure development of products in industrial automation and control. A list of popular...

Beyond Static Source Analysis

INTRODUCTION:

INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...

The software supply chain is a growing concern in software development. Security, in particular, of third party software is a risk that needs to be evaluated and managed. Binary code...

INTRODUCTION: Static analysis tools ship with a default set of error checkers that cover the most common and important types of errors. However, projects often benefit from specific...

INTRODUCTION: The recent interest in the so called “software supply chain” highlights the growing importance of using and reusing existing software. Companies realize they need to buy...

INTRODUCTION: Code reviews (or inspections) are an effective way to reduce defects in software projects. In fact, defect removal rate can be as high as 75%, meaning two thirds of all...

INTRODUCTION: The most effective tool is one that reports a good number of true positives, without too many false negatives, without consuming too much compute...

INTRODUCTION: Advanced static analysis tools are popular because they have proven effective at finding serious programming defects. In contrast to traditional dynamic testing, the...

I sometimes describe our main commercial product, CodeSonar, as a “defect detection tool.” While this is a convenient shorthand, it ignores a lot of what CodeSonar attempts to...

INTRODUCTION: GrammaTech brought unique binary code analysis to the market in 2013. Before then, the only option for binary analysis was to ship your code to specialists who would...