97 Things Every Information Security Professional Should Know

Chapter 77. Look Inside and See What Can Be

Sam Denard

Static analysis is a testing technique that reveals an analysis target’s behavior when the expression of that behavior is separated from the analysis by access, location, and/or time.

For example, a testing agent may have source code but no executable; or an executable but no permission to run it; or only requirements documents. Regardless, static analysis applies certain processes and techniques to the available source material.

The purpose of static analysis is to identify and understand an analysis target’s possible behaviors. (The existence of behavior is of concern here, not its likelihood of occurrence.) The analysis goal is to improve or otherwise control that behavior.

Source material is anything that expresses, describes, or reflects the analysis target’s behavior. This includes software in all its forms (source code, requirements, design documents, test scripts, installation procedures, etc.) as well as higher-level documents (manuals, EULAs, and contracts). The hardware controlled by the software or on which it runs is also included. Software is created and used by humans; consequently, authors’ skill and intent as well as user actions, whether benign or malicious, are also considered.

Organizational processes create the management and cultural context for analyses; this includes testing mandates, scope, resource ...