Supporting Information on Documentation - V2

Housekeeping for AIP

Mon, 01 Jan 0001 00:00:00 +0000

In order to keep AIP running smoothly and avoid ever-increasing storage consumption, there are a number of steps that you can take.

The steps below are advisory and have been put together based on the experience of working with different AIP customer

Maintenance of Source Code Folders

As soon as a scan is completed, the analysed source code can be zipped and stored in an archive folder. If the customer is using AIP Portal, then the source code should already be zipped.

Developing an Extension in AIP

Mon, 01 Jan 0001 00:00:00 +0000

This page is dedicated to understanding the principles of field extension development of extensions beyond product and product road map

There are 5 types of extension development

Adding custom rules on top of existing supported AIP technologies not in the product road map.
Creating supported extensions for unsupported AIP technologies not in the product road map
Enhancing existing user community extensions with new version support for technologies which are not in the product road map
Developing an extension using existing OpenSource code checkers to insert new metrics in AIP
Converting old UA-based technology to full-SDK-Python

The objective of creating an extension

Understanding False Positives

Mon, 01 Jan 0001 00:00:00 +0000

Version 0.2

Static analysis aims to detect quality issues and risks across the entire code base of an application, often to find issues more efficiently than time-consuming activities like testing and code reviews
In static analysis, False Positives broadly refers to issues identified by the analysis which on inspection turn out not to be real issues
The opposite of false positives is False Negatives: real issues that are not detected
- False Negatives typically get less publicity but can represent a significant risk, especially in the area of Security
There can be many different reasons for False Positives (see next slide)
- False positives may of course be due to errors or limitations in the rule implementation, but often they are also due other factors such as knowledge about the application input or environment
Implementing a rule with a good balance between false positives and false negatives is not an exact science:
- For issues with high impact like security risks, or issues that are difficult to find via testing/debugging, a few hours reviewing false positives may well be worth avoiding tricky bugs in operation that may require many days of debugging
  - Example: rare memory leaks, comparing floating numbers using equal
Seeing the forest for the trees: one false positive between 20 issues may attract most of the attention, but the most effective approach is to focus on the 19 real issues
Impact on quality grades:
- Experience shows that false positives rarely have a significant impact on the quality scores
False Positives may arise from different situations:
- The specific environment or input for an application may mean that
  certain situations will never occur in real life
  - Example: security risks may be acceptable for applications that are used by
    a small group of trusted users on a closed network
  - Example: division by 0 may never happen if input data ensures the divider can never be 0
- Specific system requirements to an application may reduce or eliminate a risk.
  - Example: for an application which is restarted for each new set of input data and only runs for a short time, memory leaks may never build up to become an issue
- The non-functional requirements to an application may influence which issues are considered ‘false positives’
  - Example: performance issues may not be relevant for code executed once a year with a full weekend available to finish processing
- Specific libraries or frameworks may eliminate issues that the application code is not handling itself
  - Example: sanitization of SQL queries
- The implementation of a specific rule may be not cover every code pattern or may contain errors
  - Example: similar syntax may have very different affects
NB. The experience-level of the developers may also influence the amount of false positives:
- Very experienced developers are better at writing high quality code, leading to a less issues and therefore a higher percentage of false positives than for junior developers

A download of this content is available here

Security of CAST Managed Services

Mon, 01 Jan 0001 00:00:00 +0000

Overall security measures

CAST cares a great deal about security.

Since 2015, CAST has maintained ISO 27001 certification for the following activities:-

Development
Quality Assurance
Release management
Operating and Facilities management

All developers are trained in secure development practices

All software and services are regularly assessed (penetration test and audit code) by third party specialists

Keeping customer source code secure

CAST does provide a managed service that can optionally be run on CAST internal infrastructure. If a customer uses this service, they can be reassured from a security perspective that:-