Application SecurityDevSecOps

The New Code Analysis Approach in The Modern DevSecOps Era

The New Code Analysis Approach in The Modern DevSecOps Era

The New Code Analysis Approach in The Modern DevSecOps Era

More software is developed now than in the past. That statement is valid for this year, and it’ll be valid next year, and indeed true for every year in the foreseeable future. More software development means more code written by more programmers. Even with the expansion in the number of developers, the demand for software to control almost everything in the modern world means more pressure to deliver applications, embedded control software, websites, and more under shorter deadlines.

The Issues with Accelerated Development Timelines

This rise in demand and the pressure to deliver software more quickly has led to some significant changes in development practices. Firstly, the need to develop and deliver results rapidly has driven the uptake in open-source and third-party code libraries. Why reinvent the wheel when there is a solution that does what you need sitting on the shelf (or in Github)? Secondly, the drive for faster results and the adoption of code reuse from outside sources has led to concerns about security vulnerabilities going undetected in applications and other code that makes it into production.

DevSecOps has emerged as a way to address the issues that have arisen from accelerated development timelines. Development teams and operations have been working closely for years via DevOps methodologies. People realised that security needed to be a core part of all software development from the start of each project, so security experts were included in the process, giving us the DevSecOps workflows and methodologies that many organisations now use. However, DevSecOps isn’t enough to address the issues that can arise from the use of open-source software in projects.

What’s needed is a multi-layer approach to code security that applies scanning using expert systems at appropriate levels. In modern software development, this means:

  • Static Application Security Testing (SAST) - incremental scans that look for vulnerabilities in newly written code.
  • Software Composition Analysis (SCA) - check open-source libraries and code for known issues.
  • Interactive Application Security Testing (IAST) - optimised testing of running applications and code by Test/QA teams as part of a broader DevSecOps process.

In the remainder of this post, we’ll focus on SCA.

The Issues with Open-Source Software Reuse

Using open-source codebases and other components to reduce the amount of new code that needs writing makes sense. According to some estimates, most development projects use third-party code or libraries, with over 80% of an average code base being open-source code.

Using this third-party code does introduce risks into the development cycle and the final released product. These risks include:

  • Security vulnerabilities in the pre-existing code or libraries can slip by security checking and make it into released products. This exposes the organisations using the code to cyberattacks and data breaches.
  • The licenses that come with open-source code libraries are often complex and can be different between available code bases. If any code used has a license that does not permit how an organisation deployed it, there is a risk of legal action, reputational damage, or portions of applications needing a rewrite to eliminate the library in question. The obvious manifestation of this issue is using a code library that prohibits commercial use in a business application, but other more subtle quandaries arise.
  • Open-source code libraries can be very dynamic in nature. This is both a plus and a minus. It’s a plus in that new functionality can be added and security vulnerabilities fixed regularly. But this can also be a minus as it can be difficult for development teams to keep up to date with rapidly changing external code. In many instances, there will be a policy to only update the version used a few times a year, but this means there will be support and maintenance overheads on the team to support older code (that they didn’t even write in the first place).

Development teams need a way to get meaningful insight into the status and vulnerabilities in any open-source software that they incorporate into their projects. This insight needs to provide risk severity metrics, detailed descriptions of the issues, and remediation guidance on addressing them. This is what a SCA solution is for and precisely what Checkmarx SCA delivers.

What is Checkmarx SCA?

Checkmarx SCA is a cloud-native SaaS software composition analysis solution that detects risks associated with open-source dependencies in software development projects. Checkmarx SCA allows development teams to identify issues easily, assess their risk, and prioritise remedial actions to address the problems. The risks it discovers and highlights include security vulnerabilities, license requirements, and outdated package use coupled with highly accurate, relevant, and actionable insights.

Checkmarx SCA is easy to use via a web portal that presents an overall picture of the projects using open-source software via a unified console. This portal UI is where development teams create projects, run scans, and view results. Organisations can also integrate Checkmarx SCA into development workflows via REST APIs, CLI tools, and plugins for specific systems.

If you want to learn more about SCA in general and Checkmarx SCA in particular, visit the Checkmarx SCA homepage and also download the free ebook available at Software Composition Analysis - The Ultimate Guide to SCA, from Checkmarx.

Find Out More

If you would like to chat with an expert on how Checkmarx SCA can make your development projects more secure and risk-free, then contact Renaissance. We partner with Checkmarx to make SCA and their other solutions available in the Irish marketplace.