Hands-On Security in DevOps

Tool evaluation

Once the team realizes the importance and the challenge of secure coding, it will look for some tools to make the secure coding easier. The evaluation of a scanning tool may include the following considerations:

Considerations	Description
Usability	The target users of the code scanning tools are developers. The usability includes the capability to scan parts of the source code, differential scans, scanning reports, tracing back to original source code, and so on.
Budget	If it's an IDE plugin commercial tool, we need to consider how many concurrent users' licenses it will need.
Programming languages support	Most tools support C/C++ and Java, but do not support script languages, such as Python, JavaScript, ...