Secure coding attracts interest, investment
A new product from computer security firm @stake Inc. will help developers search computer code for errors, security holes and other flaws that malicious hackers can use to break applications -- and break into computers.
On Monday, @stake, of Cambridge, Massachusetts will unveil SmartRisk Analyzer, an application security modeling and analysis tool that scans computer code written in the C, C++ and Java languages for flaws like buffer overflows that, if left undetected, pose security risks for customers using finished software products.
Using a technique called "deep binary analysis," the new product scans computer code after it is "compiled," or translated into binary code, the zeros and ones that are the foundation of all computer languages.
Working with compiled, as opposed to uncompiled code, allows SmartRisk Analyzer to spot flaws that may only appear when the application interacts with services on an operating system, said Chris Wysopal, vice president for research and development at @stake. Those include interactions with security APIs (application programming interfaces), cryptographic APIs or network file services, as well as improper input validation and so-called "backdoors" that would allow malicious hackers to secretly compromise machines, he said.
The product compares code to an @stake database of about 400 security and code reliability rules. It can generate reports that list flaws by type or rank them by severity. A remediation module marks erroneous code in an environment that resembles the IDEs (integrated development environments) most software developers work in, and appends suggestions for ways to fix coding mistakes, @stake said.
"We wanted to design something that could be used by somebody who wasn't a security expert," Wysopal said.
SmartRisk Analyzer is the latest addition to a small, but growing, list of automated software tools that use a process called "static analysis" to help developers and companies vet computer code for security vulnerabilities and other problems.
As opposed to so-called "dynamic" analysis tools that use automated input tests to measure the response of finished applications, static analysis tools allow developers to test for problems as they are writing code, reducing the work needed to fix those holes when they are found.
In April, Fortify Software Inc., a startup company based in Menlo Park, California, introduced Fortify Source Code Analysis, a suite of software products that lets companies compare C++ and Java code to a list of more than 500 vulnerabilities published by software quality management company Cigital Inc.
While SmartRisk Analyzer is a new entry into the category, the technology is not new. The underlying technology in SmartRisk Analyzer stems from proprietary technology developed by @stake in 1999 and used by the company's security consultants since 2002, Wysopal said.
SmartRisk Analyzer for C and C++ on Windows and Sun Microsystems Inc.'s SPARC platform will be available Monday. A version for Java will be released in June, Wysopal said. The product runs on machines using the Windows 2000, 2003 and XP operating system.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
