q2K BHP
Black History Portal
THE BHP WIRE —
HIDDEN TRUTHS
GREENWOOD / BLACK WALL STREET WILMINGTON 1898 LITTLE ROCK NINE TUSKEGEE STUDY ROSEWOOD 1923 THE TUSKEGEE AIRMEN SENECA VILLAGE BLACK TOWNS GREENWOOD / BLACK WALL STREET WILMINGTON 1898 LITTLE ROCK NINE TUSKEGEE STUDY ROSEWOOD 1923 THE TUSKEGEE AIRMEN SENECA VILLAGE BLACK TOWNS
What's New!
THE JOURNEY THROUGH TIME
BHP HOME BEFORE AMERICA 1800–1936 1937–1957 1958–1980 1981–2000 2001–PRESENT

Explore Black History

Explore the people, places, events, achievements, struggles and stories that shaped our journey.

✊🏾

Civil Rights

Movements, leaders, victories and the continuing fight for equality.

⚙️

Black Inventors

Innovation, patents, science, technology and world-changing contributions.

🏆

Sports

Pioneers, champions, Negro Leagues, records, activism and excellence.

♟️

People

Meet the people whose lives, choices and achievements shaped the journey.

📍

Places

Black towns, communities, institutions and places where history happened.

📜

Events

Moments that changed communities, movements, institutions and the nation.

Enter a person, place, event, or topic.
MY'STORY

The MOVE Fire

This is a personal recollection on the Move fire on May 13, 1985 Philadelphia police fired thousands of rounds at the MOVE house, city officials approved dropping an explosive device on the roof, the resulting fire was allowed to burn, 11 people—including five children—died, and 61 homes were destroyed. Philadelphia City Council later called it a “brutal attack carried out by the City of Philadelphia on its own citizens” and acknowledged that no individual faced criminal consequences for the bombing. One timeline correction worth preserving for the BHP record: the major previous MOVE-police confrontation was August 8, 1978, about seven years before the bombing, not a year or two earlier. Officer James Ramp was killed, other police and firefighters were wounded, nine MOVE members were later convicted, and television cameras recorded police beating Delbert Africa during his arrest. The 1985 MOVE Commission later specifically criticized city planners for failing to adequately use lessons from that 1978 confrontation. And that actually strengthens the point you’re making: 1985 did not happen without precedent or institutional memory. There had already been a deadly confrontation with MOVE, years of conflict, negotiations and police involvement before Osage Avenue.

MORE →
BLACK FACTS
The Truths They Never Taught You...

Ruler of the Mali Empire in the 14th century

Mansa Musa was the ruler of the Mali Empire in West Africa. Details recorded here should be sourced; unknown information is left blank.

MORE →
BHP gathered finds from its connected research sources. Showing the 4 strongest Black History matches.
← BACK TO RESULTS
Wikipedia

Static application security testing

Static application security testing (SAST) is used to secure software by reviewing its source code to identify security vulnerabilities. Although the process of checking programs by reading their code (modernly known as static program analysis) has existed as long as computers have existed, the technique spread to security in the late 90s and the first public discussion of SQL injection in 1998 when web applications integrated new technologies like JavaScript and Flash.

Unlike dynamic application security testing (DAST) tools for black-box testing of application functionality, SAST tools focus on the code content of the application, white-box testing. A SAST tool scans the source code of applications and their components to identify potential security vulnerabilities in their software and architecture. Static analysis tools can detect an estimated 50% of existing security vulnerabilities in tested applications.[1]

In the software development life cycle (SDLC), SAST is performed early in the development process and at code level, and also when all pieces of code and components are put together in a consistent testing environment. SAST is also used for software quality assurance,[2] even if the many resulting false positives impede its adoption by developers.[3]

SAST tools are integrated into the development process to help development teams as they are primarily focusing on developing and delivering software respecting requested specifications.[4] SAST tools, like other security tools, focus on reducing the risk of downtime of applications or that private information stored in applications is not compromised.

Overview

[edit]

Application security tests conducted before their release include static application security testing (SAST), dynamic application security testing (DAST), and interactive application security testing (IAST), which is a combination of the two.[5]

Static analysis tools examine the text of a program syntactically. They look for a fixed set of patterns or rules in the source code. Theoretically, they can also examine a compiled form of the software. This technique relies on instrumentation of the code to do the mapping between compiled components and source code components to identify issues. Static analysis can be done manually as a code review or auditing of the code for different purposes, including security, but it is time-consuming.[6]

The precision of SAST tools is determined by their scope of analysis and the specific techniques used to identify vulnerabilities. Different levels of analysis include the following:

The scope of the analysis determines its accuracy and capacity to detect vulnerabilities using contextual information.[7] SAST tools, unlike DAST tools, give developers real-time feedback, and help them secure flaws before they move the code to the next level.

At a function level, a common technique is the construction of an Abstract syntax tree to control the flow of data within the function.[8]

Since the late 90s, the need to adapt to business challenges has transformed software development with componentization[9] enforced by processes and organization of development teams.[10] Following the flow of data between all the components of an application or group of applications allows validation of required calls to dedicated procedures for sanitization and that proper actions are taken to taint data in specific pieces of code.[11][12]

The rise of web applications entailed testing them: Verizon Data Breach reported in 2016 that 40% of all data breaches use web application vulnerabilities.[13] Both external security validations and a focus on internal threats have risen. The Clearswift Insider Threat Index (CITI) has reported that 92% of their respondents in a 2015 survey said they had experienced IT or security incidents in the previous 12 months and that 74% of these breaches were originated by insiders.[14][15] Lee Hadlington categorized internal threats in 3 categories: malicious, accidental, and unintentional. Mobile applications' explosive growth implies securing applications earlier in the development process to reduce malicious code development.[16]

SAST strengths

[edit]

The earlier a vulnerability is fixed in the SDLC, the cheaper it is to fix. Costs to fix in development are 10 times lower than in testing, and 100 times lower than in production.[17] SAST tools run automatically, either at the code level or application-level and do not require interaction. When integrated into a CI/CD context, SAST tools can be used to automatically stop the integration process if critical vulnerabilities are identified.[18]

Another advantage over other types of testing is that SAST tools scan the entire source code, while dynamic application security testing tools cover its execution, possibly missing part of the application[5] or unsecured configuration in configuration files.

SAST tools can offer extended functionalities such as quality and architectural testing. There is a direct correlation between software quality and security. Bad quality software is also poorly secured software.[19]

SAST weaknesses

[edit]

Even though developers are positive about the usage of SAST tools, there are different challenges to their adoption.[4] As an example, research shows that despite the long output generated by these tools, they may lack usability.[20]

With Agile Processes in software development, early integration of SAST generates many bugs, as developers using this framework focus first on features and delivery.[21]

Scanning many lines of code with SAST tools may result in hundreds or thousands of vulnerability warnings for a single application. It can generate many false positives, increasing investigation time and reducing trust in such tools. This is particularly the case when the context of the vulnerability cannot be caught by the tool.[3]

See also

[edit]

References

[edit]
  1. ^ Okun, V.; Guthrie, W. F.; Gaucher, H.; Black, P. E. (October 2007). "Effect of static analysis tools on software security: Preliminary investigation" (PDF). Proceedings of the 2007 ACM workshop on Quality of protection. ACM. pp. 1–5. doi:10.1145/1314257.1314260. ISBN 978-1-59593-885-5. S2CID 6663970.
  2. ^ Ayewah, N.; Hovemeyer, D.; Morgenthaler, J.D.; Penix, J.; Pugh, W. (September 2008). "Using static analysis to find bugs". IEEE Software. 25 (5). IEEE: 22–29. doi:10.1109/MS.2008.130. S2CID 20646690.
  3. ^ a b Johnson, Brittany; Song, Yooki; Murphy-Hill, Emerson; Bowdidge, Robert (May 2013). "Why don't software developers use static analysis tools to find bugs?". 2013 35th International Conference on Software Engineering (ICSE). pp. 672–681. doi:10.1109/ICSE.2013.6606613. ISBN 978-1-4673-3076-3.
  4. ^ a b Oyetoyan, Tosin Daniel; Milosheska, Bisera; Grini, Mari (May 2018). "Myths and Facts About Static Application Security Testing Tools: An Action Research at Telenor Digital". International Conference on Agile Software Development. Springer: 86–103.
  5. ^ a b Parizi, R. M.; Qian, K.; Shahriar, H.; Wu, F.; Tao, L. (July 2018). "Benchmark Requirements for Assessing Software Security Vulnerability Testing Tools". 2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC). IEEE. pp. 825–826. doi:10.1109/COMPSAC.2018.00139. ISBN 978-1-5386-2666-5. S2CID 52055661.
  6. ^ Chess, B.; McGraw, G. (December 2004). "Static analysis for security". IEEE Security & Privacy. 2 (6). IEEE: 76–79. doi:10.1109/MSP.2004.111.
  7. ^ Chess, B.; McGraw, G. (October 2004). "Risk Analysis in Software Design". IEEE Security & Privacy. 2 (4). IEEE: 76–84. doi:10.1109/MSP.2004.55.
  8. ^ Yamaguchi, Fabian; Lottmann, Markus; Rieck, Konrad (December 2012). "Generalized vulnerability extrapolation using abstract syntax trees". Proceedings of the 28th Annual Computer Security Applications Conference. Vol. 2. IEEE. pp. 359–368. doi:10.1145/2420950.2421003. ISBN 9781450313124. S2CID 8970125.
  9. ^ Booch, Grady; Kozaczynski, Wojtek (September 1998). "Component-Based Software Engineering". IEEE Software. 15 (5): 34–36. doi:10.1109/MS.1998.714621. S2CID 33646593.
  10. ^ Mezo, Peter; Jain, Radhika (December 2006). "Agile Software Development: Adaptive Systems Principles and Best Practices". Information Systems Management. 23 (3): 19–30. doi:10.1201/1078.10580530/46108.23.3.20060601/93704.3. S2CID 5087532.
  11. ^ Livshits, V.B.; Lam, M.S. (May 2006). "Finding Security Vulnerabilities in Java Applications with Static Analysis". USENIX Security Symposium. 14: 18.
  12. ^ Jovanovic, N.; Kruegel, C.; Kirda, E. (May 2006). "Pixy: A static analysis tool for detecting Web application vulnerabilities". 2006 IEEE Symposium on Security and Privacy (S&P'06). IEEE. pp. 359–368. doi:10.1109/SP.2006.29. ISBN 0-7695-2574-1. S2CID 1042585.
  13. ^ "2016 Data Breach Investigations Report" (PDF). Verizon. 2016. Retrieved 8 January 2016.
  14. ^ "Clearswift report: 40 percent of firms expect a data breach in the Next Year". Endeavor Business Media. 20 November 2015. Retrieved 8 January 2024.
  15. ^ "The Ticking Time Bomb: 40% of Firms Expect an Insider Data Breach in the Next 12 Months". Fortra. 18 November 2015. Retrieved 8 January 2024.
  16. ^ Xianyong, Meng; Qian, Kai; Lo, Dan; Bhattacharya, Prabir; Wu, Fan (June 2018). "Secure Mobile Software Development with Vulnerability Detectors in Static Code Analysis". 2018 International Symposium on Networks, Computers and Communications (ISNCC). pp. 1–4. doi:10.1109/ISNCC.2018.8531071. ISBN 978-1-5386-3779-1. S2CID 53288239.
  17. ^ Hossain, Shahadat (October 2018). "Rework and Reuse Effects in Software Economy". Global Journal of Computer Science and Technology. 18 (C4): 35–50.
  18. ^ Okun, V.; Guthrie, W. F.; Gaucher, H.; Black, P. E. (October 2007). "Effect of static analysis tools on software security: Preliminary investigation" (PDF). Proceedings of the 2007 ACM workshop on Quality of protection. ACM. pp. 1–5. doi:10.1145/1314257.1314260. ISBN 978-1-59593-885-5. S2CID 6663970.
  19. ^ Siavvas, M.; Tsoukalas, D.; Janković, M.; Kehagias, D.; Chatzigeorgiou, A.; Tzovaras, D.; Aničić, N.; Gelenbe, E. (August 2019). "An Empirical Evaluation of the Relationship between Technical Debt and Software Security". In Konjović, Z.; Zdravković, M.; Trajanović, M. (eds.). International Conference on Information Society and Technology 2019 Proceedings (Data set). Vol. 1. pp. 199–203. doi:10.5281/zenodo.3374712.
  20. ^ Tahaei, Mohammad; Vaniea, Kami; Beznosov, Konstantin (Kosta); Wolters, Maria K (6 May 2021). "Security Notifications in Static Analysis Tools: Developers' Attitudes, Comprehension, and Ability to Act on Them". Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. pp. 1–17. doi:10.1145/3411764.3445616. ISBN 9781450380966. S2CID 233987670.
  21. ^ Arreaza, Gustavo Jose Nieves (June 2019). "Methodology for Developing Secure Apps in the Clouds. (MDSAC) for IEEECS Confererences". 2019 6th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/ 2019 5th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom). IEEE. pp. 102–106. doi:10.1109/CSCloud/EdgeCom.2019.00-11. ISBN 978-1-7281-1661-7. S2CID 203655645.

Source: Wikipedia. Article content is retrieved live through the MediaWiki API.

No preview image
Wikipedia

Static application security testing

Static application security testing (SAST) is used to secure software by reviewing its source code to identify security vulnerabilities. Although the process of checking programs by reading their code (modernly known as static program analysis) has existed as long as computers have existed, the technique spread to security in the late 90s and the first public discussion of SQL injection in 1998 when web applications integrated new technologies like JavaScript and Flash. Unlike dynamic application security testing (DAST) tools for black-box testing of application functionality, SAST tools focus on the code content of the application, white-box testing. A SAST tool scans the source code of applications and their components to identify potential security vulnerabilities in their software and architecture. Static analysis tools can detect an estimated 50% of existing security vulnerabilities in tested applications. In the software development life cycle (SDLC), SAST is performed early in the development process and at code level, and also when all pieces of code and components are put together in a consistent testing environment. SAST is also used for software quality assurance, even if the many resulting false positives impede its adoption by developers. SAST tools are integrated into the development process to help development teams as they are primarily focusing on developing and delivering software respecting requested specifications. SAST tools, like other security tools, focus on reducing the risk of downtime of applications or that private information stored in applications is not compromised.

MORE →
Wikipedia

Static load testing

Static load testing is an in situ type of load testing used in geotechnical investigation to determine the bearing capacity of deep foundations prior to the construction of a building. It differs from the statnamic load test and dynamic load testing in that the pressure applied to the pile is slower. Static load testings are performed in order to measure a design's axial tension or axial compression. It can also be used to measure its deflected shape under lateral load.

MORE →
No preview image
Wikipedia

Dynamic testing

In software development, dynamic testing (or dynamic analysis) is examining the runtime response from a software system to particular input (test case). Tests can be run manually or via automation. Unit testing, integration testing, system testing, regression testing and acceptance testing are forms of dynamic testing. In contrast to static testing, the software must be runnable.

MORE →
No preview image
Wikipedia

Zwick Roell Group

The ZwickRoell Group is a manufacturer of static testing machines and systems for materials and components testing used to evaluate the mechanical and physical properties and performance of materials and components. Core static tests carried out with this equipment includes tensile, compression, flexure (also referred to as bend), and cycling. The company operates in 56 countries, has manufacturing facilities in Germany, UK and China, and strategic headquarters in the US and Singapore. As of 2014 the Group employs 1250 staff in its international operations. It generates revenues of approximately 210 million euros. Zwick manufactures a range of testing systems for research and routine testing of materials and components. It has developed materials testing software, digital contact and non contact extensometry and pioneered robotic materials testing systems.

MORE →
TOPIC OF THE DAY

Greenwood / Black Wall Street

Before the 1921 destruction of Tulsa’s Greenwood District, Black residents had created a remarkable center of business and community life. The district included stores, professional offices, entertainment venues and homes owned by Black citizens. Understanding Greenwood means learning what was built—not only what was burned.

MORE →
TRIVIA QUESTION OF THE DAY

Who became the first Black woman to travel into space?

Mae Jemison, aboard Space Shuttle Endeavour in 1992.