How to automate static analysis in your SDLC

Posted by Charlie Klein on Tuesday, February 26, 2019

Automating static analysis in your SDLC requires a tool that integrates into daily workflows, presents results intuitively, and offers remediation guidance.

As attacks on the application layer increase and businesses ask developers to produce software faster, security and development teams must satisfy demands for more secure software without sacrificing rapid application development.

The speed and complexity of modern software development is increasing, so traditional security testing methodologies—such as testing applications after they are completed—must adapt to keep pace with development. Static application security testing (SAST) has long helped developers find security weaknesses and quality defects in their code. Modern SAST tools with integrated development environment (IDE) plugins that highlight issues in real time are intuitive solutions for rapid remediation.

While static analysis has the potential to make development more productive and secure, these benefits are far from guaranteed. Some developers find static analysis distracting and invasive. Others grow frustrated with the inaccuracy of SAST, which causes them to waste time separating false positives from true positives. To make SAST an integral part of the software development life cycle (SDLC), it must support developers and their goals.

Ensure security and boost productivity

Designed for development teams, Coverity is an accurate and comprehensive SAST solution that can scan software at the same fast, iterative rate that it’s produced. Development teams can use Coverity to automate static analysis wherever it’s most convenient for them in the SDLC. To enable flexible DevOps integrations and deployment options, the Coverity analysis engine can be used in multiple ways:

Coverity on-premises. Those hoping to keep their analysis projects on-premises can deploy Coverity locally and Coverity Connect to manage their SAST projects.
Coverity on Polaris. Polaris is a cloud-based platform that delivers Coverity as a service to enable quick time to value and seamless scaling.
Code Sight. As part of the Polaris platform, Code Sight is an IDE plugin that analyzes source code in the background as it’s being written in real time.

While some teams prefer to find security vulnerabilities and quality defects in their IDE as they’re writing code, others prefer to automate static analysis into their CI/CD pipelines. Development teams can choose any combination of the offerings above—so they can determine the best approach to securing their SDLC on a per-project basis.

By automating static analysis in the IDE or CI/CD pipeline, Coverity reduces the time it takes to debug code. The tools described above meet three crucial requirements to help development teams find and fix security weaknesses quickly:

They can be automated and integrated into developer workflows without disrupting day-to-day activities.
They present accurate results in a noninvasive, intuitive way.
They offer actionable remediation guidance and developer education.