CAST Engineering Dashboard - Grades - Variation

Purpose (problem description)

This page describes how to investigate differences in the business criteria grade (for example security grade) between two snapshots when the source code does not change between two versions.

Observed in CAST AIP

Observed on RDBMS

Action Plan

1. Special Cases
2. Relevant customer’s input
3. If the difference in the grade is at the system level
4. If the difference in the grade is at the application level
5. If the difference in the grade is at the module level
6. If relevant, use the following action: Contact CAST Support with input .

Special Cases

Special Cases

CASE #1:

This may be due to changes in your module configuration and the effect of shared objects.

For example, if you have 4 analysis units, DB1, DB2, CODE1, and CODE2.

• If you then create a module - MOD1 - which has CODE1, DB1, and DB2, and then create another module - MOD2 - which has CODE2, DB1, and DB2, then both modules will contain violations for the DB1 and DB2 analysis units, and you’ll see some affects of this on the dashboard due to this configuration of your modules.
• You may also have created an object filter on your module which is not filtering as initially expected, so that instead of getting a subset of the items that have been analyzed, you would get the full content of the application.  In the case with an improperly configured module filter, MOD1 may in fact contain DB1, DB2, CODE1, and CODE2, and MOD2 may also contain DB1, DB2, CODE1, and CODE2 analysis units which would effectively double the results of your dashboard violations when looking at the entire application.

To determine if you have shared objects between modules, you can run this query on the central:

SELECT DISTINCT o.OBJECT_ID AS SHARED_OBJECT, obj.OBJECT_NAME, obj.OBJECT_FULL_NAME, o.SNAPSHOT_ID
 FROM DSS_OBJECT_INFO o JOIN DSS_OBJECTS obj ON obj.OBJECT_ID=o.OBJECT_ID join DSS_LINK_INFO l1 ON o.SNAPSHOT_ID = l1.SNAPSHOT_ID and l1.NEXT_OBJECT_ID = o.OBJECT_ID and l1.LINK_TYPE_ID in ( 3, -3 ) where exists ( select 1 from DSS_LINK_INFO l2 where l2.SNAPSHOT_ID = o.SNAPSHOT_ID and l2.NEXT_OBJECT_ID = o.OBJECT_ID and l2.LINK_TYPE_ID in ( 3, -3 ) and l1.PREVIOUS_OBJECT_ID <> l2.PREVIOUS_OBJECT_ID )  and 
o.SNAPSHOT_ID= <replace_here_the_snapshot_id> 
Order by o.SNAPSHOT_ID, o.OBJECT_ID

The SNAPSHOT_ID in the above query can be obtained by running this query on the central and selecting the SNAPSHOT_ID for the snapshot which you want to run the query against:

select * from DSS_SNAPSHOTS; 

If the above query returns a value, this justifies the behavior at application level only. A shared object will be counted as many time as it’s shared between the modules/subsets of the application. The shared object is displayed only one time in the list of the very high risk objects.  

To resolve this issue, you would need to configure your modules so that they no longer contain shared objects.

For example, in the first example described in this case you could create four separate and distinct modules:

MOD1 - CODE1

MOD2 - CODE2

MOD3 - DB1

MOD4 - DB2

In the second example described in this case, you would need to modify your object filter to properly select only the code you had planned for in each module.

CASE #2 :
The number of violation on metric “Avoid Functions and Procedures doing an Insert, Update, Delete, Create Table or Select without including error management” is unexpectedly high when compared to previous versions of CAST-MS (7.0).
This issue is a known bug which is caused due to the objects being shared between the two subsets coming from new SQL analyzer & legacy analyzer.
In 7.3 the SQL server technology should be replaced with Microsoft SQL. So the way to reduce the failed checks/avoid repeated counts would be by deactivating the database subset. As a workaround you must set the database subset to Inactive under the modules tab in the CMS and run a full analysis followed by snapshot generation. This issue is fixed in 7.3.4

CASE #3 :

The grade of the technical criterion is lowered in the second version of analysis because of the grade degradation of one of the Quality rules belonging to the Technical Criteria. However, this quality rule is violated by only one object that has not changed since the first version of analysis  (unchanged object, unchanged violation). 
This is expected behaviour considering the two explanations below -

1. This can be explained by the fact that the total check has been reduced (if you have 1 violation among 1000 objects checked (0.1%), you will have a greater grade than if you have 1 violation among 2 objects checked (50%), although the object violating the rule is unchanged). For this please check the computing details tab for further information
2. The second case is, if total check is the same, the explanation could be that the threshold for this metric has been changed, this also can be checked in the computing details tab

Relevant customer’s input

1. Sherlock (Needed: Central Base)
2. Screenshots showing the issue with the url visible (screenshots for the two values of the grade)

if the difference in the grade is at the system level

If the difference in the grade is at the system level

The grade at system level is displayed for example in the left panel of the assessment portfolio - level page (FRAME_PORTAL_PORTFOLIO_VIEW)

To investigate differences in the grade at system level, you need to:

1. Go to the quick access.
2. Check that all the applications present in the current version are present in the previous one.
3. If some applications are not present in both version, this may explain the differences. You cannot compare results at system level as the configuration is no longer the same.
4. If all applications are present in both version, then for each application do the following:

   1. Check the box corresponding to the two last snapshot and click on “monitor”

   2. You will get the business criteria grade values for both versions of the application

      Info

After clicking on the monitor button, you can get the following warning. This warning indicates configuration changes. If the indicated change is regarding metric computation (assessment model). This could explain the issue. Please refer to the “how to compute the grades” page to check the configuration differences