Top Posts & Pages
Recent Posts
My Book
Pro .NET Best Practices
@RuthlessHelp
- The implicit and hidden agendas of the Pakled-Customer. ruthlesslyhelpful.net/2020/04/18/we-… https://t.co/qmmcreldhS 2 years ago
- Apple, please fix my Face ID, k thanks. https://t.co/4kBtIQPEX8 2 years ago
- Winmore is #cloud software that helps #logistics companies improve how they qualify bids and align their teams in o… twitter.com/i/web/status/1… 4 years ago
- @kojoshow I just started recently. The first few times I drove I only picked up one rider. Yesterday I picked up 3… twitter.com/i/web/status/9… 5 years ago
- RT @kojoshow: It's Your Turn on the Kojo Show & we're talking about slugging--sharing a car with strangers so you can use the HOV lane. Hav… 5 years ago
Ruthlessly Helpful 
Don’t keep us in suspense … What did they say? :-)
@domz82 Cheers! Unfortunately, as it turned out, I couldn’t make SDC. A couple of my colleagues were there. I will post an update once I have more information.
I attended the SDC this month, where they mentioned the importance of static analysis tools, and the consequences of not addressing security vulnerabilities during development. However, they didn’t go into detail about security-oriented static analysis or show any recommended tools. Some speakers did show some high-level metrics about how their vulnerabilities would go down after measuring and tackling them.
Personally, I would recommend HP’s Fortify/WebInspect set of tools for security-related code analysis, both dynamic and static. I also spoke to an IBM representative in the audience, who suggested IBM’s AppScan as well.
In the sessions I’ve attended they’ve mentioned only the static analysis Visual Studio will ship with and how to use SAL (source annotation language) to expand its capabilities to your own source code. The rest of the talks covered other tools they have to complement SDLC but zero mentions about CAT.NET.
@pba, thanks for the info on VS and SAL. For those interested, I found more info at these links:
http://blogs.msdn.com/b/codeanalysis/archive/2012/03/09/what-s-new-in-code-analysis-for-visual-studio-11.aspx
http://msdn.microsoft.com/en-us/library/windows/apps/hh441480(v=vs.85).aspx
http://blogs.msdn.com/b/michael_howard/archive/2006/05/19/602077.aspx
@Shahed C, the HP tool set is very helpful. It identifies many important vulnerabilities. For those interested, here is a Fortify blog with lots of info: http://blog.fortify.com/blog/
If you’d like info on getting started with IBM AppScan, take a look at this post: http://realsearchgroup.org/SEMaterials/tutorials/appscan/