Bad and good news about using software assurance tools
Bad and good news about using software assurance tools
复制标题
关于使用软件保障工具的坏消息和好消息
DOI：
--
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
V. Basupalli
中科院分区：
文献类型：
--
作者：
J. Kupsch;E. Heymann;B. Miller;V. Basupalli
软件保证工具-扫描程序的源代码或二进制代码以发现漏洞的工具-是评估软件项目安全性的第一道防线。尽管有大量这样的工具可用，几乎每种编程语言都有多个工具，但这些工具的采用充其量是参差不齐的。尽管不同的工具有不同的能力来发现不同类型的弱点，但使用多种工具的情况更不常见。当这些工具被使用（或试图使用）时，它们的使用方式往往会降低其有效性。我们将逐步讨论如何使用软件保证工具，并描述在此过程中可能出现的挑战。我们还提出了定量证据的影响，可能会发生时，保证工具被应用在一个简单或天真的方式。本演示文稿基于我们使用各种保证工具的直接经验。然后，我们介绍了美国国土安全部资助的软件保障市场（SWAMP），这是一个开放的设施，用户可以上传他们的软件，通过各种工具对其进行自动和持续的评估。SWAMP的目标是简化程序员使用保证工具的任务，从而消除采用这些工具的许多障碍。版权所有© 2016作者。软件：实践与经验出版社：John Wiley & Sons，Ltd.
Software assurance tools – tools that scan the source or binary code of a program to find weaknesses – are the first line of defense in assessing the security of a software project. Even though there are a plethora of such tools available, with multiple tools for almost every programming language, adoption of these tools is spotty at best. And even though different tools have distinct abilities to find different kinds of weaknesses, the use of multiple tools is even less common. And when the tools are used (or attempted to be used), they are often used in ways that reduce their effectiveness. We present a step‐by‐step discussion of how to use a software assurance tool, describing the challenges that can occur in this process. We also present quantitative evidence about the effects that can occur when assurance tools are applied in a simplistic or naive way. We base this presentation on our direct experiences with using a wide variety of assurance tools. We then present the US Department of Homeland Security funded Software Assurance Marketplace (SWAMP), an open facility where users can upload their software to have it automatically and continually assessed by a variety of tools. The goal of the SWAMP is to simplify the task of the programmer in using assurance tools, thereby removing many of the obstacles to their adoption. Copyright © 2016 The Authors. Software: Practice and Experience Published by John Wiley & Sons, Ltd.