4.1 - Static Code Analysis

Goal

Employ tools like Semgrep and Software Composition Analysis (SCA) tools to detect vulnerabilities in the codebase. This automated step identifies common vulnerabilities and coding errors, accelerating the review process and helping to ensure that critical issues are not overlooked.

How to Execute

1. Select and Configure Tools
   • Description: Choose appropriate static analysis tools that can effectively identify a range of vulnerabilities in the code. Semgrep is used for pattern-based scanning to detect complex coding issues, while SCA tools focus on vulnerabilities related to external libraries and dependencies.
   • Tools/Techniques:
     • Configure Semgrep with custom rules tailored to the specific security policies and coding standards of your project to enhance its effectiveness.
     • Set up SCA tools to scan for known vulnerabilities within the libraries and packages used by the application.
   • Output: A configured set of static analysis tools ready to scan the codebase.

1. Run Scans and Analyze Results
   • Description: Execute the static analysis tools against the entire codebase to uncover potential security issues, such as SQL injections, cross-site scripting (XSS), insecure deserialization, and other common vulnerabilities.
   • Tools/Techniques:
     • Schedule regular scans as part of the continuous integration/continuous deployment (CI/CD) pipeline to ensure ongoing assessment of the code.
     • Analyze the results to identify false positives and prioritize true positives based on their impact and exploitability.
   • Output: A comprehensive report of vulnerabilities detected by the static analysis tools, including details on the nature of each vulnerability, its location within the codebase, and preliminary recommendations for mitigation.

1. Document Findings for Review
   • Description: Ensure that all findings from the static code analysis are documented and categorized appropriately for further review and validation.
   • Tools/Techniques:
     • Use tools like DefectDojo to record, categorize, and manage the findings.
     • Provide a mechanism within the documentation tool to link directly to the affected code segments for easier access and review by developers and security analysts.
   • Output: Documented findings from the static analysis, organized in a central repository such as DefectDojo, making them ready for further scrutiny and action.