Search

Your search keyword '"code vulnerabilities, security weaknesses"' showing total 2 results
Start Over Descriptor "code vulnerabilities, security weaknesses"
2 results on '"code vulnerabilities, security weaknesses"'

1. THE EXPERIENCE OF COMPARISON OF STATIC SECURITY CODE ANALYZERS

Author

Alexey Markov, Andrew Fadin, Vladislav Shvets, and Valentin Tsirlov

Subjects
information security, software security, static analysis, code vulnerabilities, security weaknesses, undocumented features, program testing, security audit, Construction industry, HD9715-9717.5
Abstract

This work presents a methodological approach to comparison of static security code analyzers. It substantiates the comparison of the static analyzers as to efficiency and functionality indicators, which are stipulated in the international regulatory documents. The test data for assessment of static analyzers efficiency is represented by synthetic sets of open-source software, which contain vulnerabilities. We substantiated certain criteria for quality assessment of the static security code analyzers subject to standards NIST SP 500-268 and SATEC. We carried out experiments that allowed us to assess a number of the Russian proprietary software tools and open-source tools. We came to the conclusion that it is of paramount importance to develop Russian regulatory framework for testing software security (firstly, for controlling undocumented features) and evaluating the quality of static security code analyzers.

Published
2015

2. THE EXPERIENCE OF COMPARISON OF STATIC SECURITY CODE ANALYZERS

Author

Vladislav Shvets, Andrew Fadin, Alexey Markov, and Valentin Tsirlov

Subjects
undocumented features, Security analysis, software security, security audit, Database, information security, business.industry, Computer science, lcsh:HD9715-9717.5, Static program analysis, Information security, Static analysis, Computer security model, program testing, computer.software_genre, Security testing, static analysis, lcsh:Construction industry, Security service, Software security assurance, Software engineering, business, computer, code vulnerabilities, security weaknesses
Abstract

This work presents a methodological approach to comparison of static security code analyzers. It substantiates the comparison of the static analyzers as to efficiency and functionality indicators, which are stipulated in the international regulatory documents. The test data for assessment of static analyzers efficiency is represented by synthetic sets of open-source software, which contain vulnerabilities. We substantiated certain criteria for quality assessment of the static security code analyzers subject to standards NIST SP 500-268 and SATEC. We carried out experiments that allowed us to assess a number of the Russian proprietary software tools and open-source tools. We came to the conclusion that it is of paramount importance to develop Russian regulatory framework for testing software security (firstly, for controlling undocumented features) and evaluating the quality of static security code analyzers.

Published
2015
Full Text
View/download PDF

Catalog

Books, media, physical & digital resources
See catalog results