Integrating Static Code Analysis, with Fortify SCA, into your Agile SDLC

No ratings

Presented at Bsidesottawa 2015 by

Paul Kitor

Static Code Analysis is the fundamental best practice for identifying and remediating security vulnerabilities in your application source code. Research has shown that the cost to remediate a security vulnerability in your application rises dramatically as your progress through the software development life cycle. Identifying application security issues early in the SDLC is the best way to keep your projects on budget and schedule. Agile projects adopt a highly iterative development life cycle that incorporates and relies on continuous feedback about software quality. The needs of agile project teams are unique when it comes to their SDLC. Adding Static Code Analysis to agile best practices like: continuous build and integration, team meetings, pairs programming, etc. is a great way to implement a secure agile SDLC. This presentation will introduce the topic of Static Code Analysis as it pertains to implementing a secure agile SDLC including demos of using Foritfy SCA in an agile Java environment