Hands-On Security in DevOps

Static code review

Static code scanning tools are used during daily builds or whenever code is submitted for scanning. It's the most effective method to identify security issues at the very beginning of software development. There are various kinds of static code scanning techniques. Refer to the OWASP Benchmark project if you would like to further evaluate these tools (https://www.owasp.org/index.php/Benchmark):

Techniques	What is it?	Examples
Static Application Security Testing (SAST)	Static code scanning. Developers can use the tool as part of the IDE plug-in or trigger scanning together with the daily build. It's considered a basic code scanning tool since it's easy for developers to use.	FindSecbugs, Fortify, Coverity, ...