[计算机软件及应用]1Fortify Source Code Analysis Suite介绍.pptVIP

上海码德信息技有限公司 会议主题 软件安全实践与软件开发过程 Fortify Source Code Analysis Suite介绍 Fortify SCASCM演示 Question? 软件安全实践与软件开发过程 Fortify Software Analysis Suite Fortify Source Code Analysis Suite介绍 什么是Fortify Source Code Analysis Suite Fortify Source Code Analysis Suite的组成及组件介绍 Fortify Source Code Analysis Suite的工作原理介绍. 什么是Fortify Source Code Analysis Suite Fortify Source Code Analysis Suite是美国Fortify Software为软件开发企业提供的软件源代码安全漏洞扫描、分析和管理的工具。使用该工具能弥补软件开发人员、安全人员和管理人员在源代码方面的安全知识不足，加速代码安全审计和方便软件安全风险的管理。 Fortify SCA的组成及组件介绍 Fortify Source Code Analysis Engine(源代码安全分析引擎) Fortify Secure Code rules（软件安全代码规则集） Fortify Audit Workbench （安全审计工作台） Fortify Rules Builder(安全代码规则构建器） Fortify Source Code Analysis Suite plug in（Fortify SCA IDE集成开发插件) Fortify Manager（软件安全管理器） Fortify SCA的组成及组件介绍 Source Code Analysis Engine Analyzers Data Flow Analyzer Control Flow Analyzer Semantic Analyzer Structural Analyzer Configuration Analyzer Analyzers: Data Flow Follows the propagation of tainted data starting from a Source (function that introduces any input source to the program), through intermediate function calls until it reaches a Sink (potentially vulnerable function) Example Analyzers: Control Flow Looks for dangerous sequences of operations Example Analyzers: Semantic Looks for unsafe function calls (based on their signature) Signature consists of package (namespace)/class/function/parameters Example Function gets() defined in libc Function whose name fits the reg-ex: /^mem*/ Function strcpy() that takes a char* as its first and second parameter Function foo() defined in classes inherited from class Bar And so on… Analyzers: Structural Detects potentially dangerous flaws in the structure or definition of the program Example Servlet member fields may allow one user to see another users data. public class GuestBook extends HttpServlet { String cc_num; protected void doPost (HttpServletRequest req, HttpServletResponse res){ cc_num = req.getParameter(CC_number); ... out.printl