Secure Programming with Static Analysis

Contents

Part I: Software Security and Static Analysis

1. The Software Security Problem

1.1 Defensive Programming Is Not Enough

1.2 Security Features != Secure Features

1.3 The Quality Fallacy

1.4 Static Analysis in the Big Picture

1.5 Classifying Vulnerabilities

The Seven Pernicious Kingdoms

1.6 Summary

2. Introduction to Static Analysis

2.1 Capabilities and Limitations of Static Analysis

2.2 Solving Problems with Static Analysis

Type Checking

Style Checking

Program Understanding

Program Verification and Property Checking

Bug Finding

Security Review

2.3 A Little Theory, a Little Reality

Success Criteria

Analyzing the Source vs. Analyzing Compiled Code

Summary

3. Static Analysis as Part of the Code Review Process

3.1 Performing a Code Review ...