In this white paper:
Static analysis tools for finding programming problems have been around for decades. The early generation tools are nowadays considered quite primitive.
These tools have more recently been superseded by advanced tools such as CodeSonar.
But how are they different? This paper compares the quality of results, the kinds of defects that primitive tools can't find, the user interfaces, and several other key differences.
For more GrammaTech white papers, click here.
INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...
INTRODUCTION: The security threat posed by insiders is often underestimated. According to an IBM study, 32% of attackers are insiders and 24% are “inadvertent actors” (e.g. people...
Security concerns should guide decisions from the earliest stages through the full software development lifecycle in order to safeguard the Industry 4.0 architecture.
INTRODUCTION: Code reviews (or inspections) are an effective way to reduce defects in software projects. In fact, defect removal rate can be as high as 75%, meaning two thirds of all...
INTRODUCTION: The most effective tool is one that reports a good number of true positives, without too many false negatives, without consuming too much compute...
INTRODUCTION: VDC’s recent report “Software Assembly Practices Necessitate More Precautions” highlights a significant software challenge for IoT device manufacturers. A majority of...
Taint checking? This isn't a trap, I promise. It sounds vulgar, but its etymology is perfectly reasonable, stemming from the notion that data that has been "tainted" by a...
Being in the marketing department at a cyber-security research firm, I'm often struck by how little the average person worries about cyber security. Friends and strangers who ask me...
INTRODUCTION: The Industrial Internet of Things is unique in that devices that compose industrial control systems are often insecure due to limitations in their design and capability....
INTRODUCTION: The Internet of Things is coming to industrial systems in a big way (the “IIOT”). But IIOT isn't just IOT with an extra 'I' -- industrial systems differ greatly in...
INTRODUCTION: The promise of static analysis is compelling but our most frequently-asked question is, "Where do we start?" Security is a top-of-mind concern, so we are also frequently...
2:32CodeSonar's tainted dataflow analysis allows you to explore potentially dangerous data flows in a clear, visual way.
INTRODUCTION: Every IoT and embedded device manufacturer endeavors to field secure and safe products. However, even with the robust development processes, it's difficult to ensure...
