Security Code Review with Static Analysis Techniques for the Detection and Remediation of Security Vulnerabilities

Search for this publication on Google Scholar
Thomas, T. (2018). Security Code Review with Static Analysis Techniques for the Detection and Remediation of Security Vulnerabilities. Unc Charlotte Electronic Theses And Dissertations.
Download PDF

Analytics

3687 views ◎
370 downloads ⇓


Abstract

Security problems are both a large and growing concern today. Many security breaches are the result of security vulnerabilities introduced during the code construction phase. These vulnerabilities sometimes occur due to poor security training of the developer, and sometimes they are simply created by accident. Static analysis, examination of the application source code with a specialty tool, is the current solution to this problem. Unfortunately, this process produces an extremely large amount of false positives. It also cannot detect application specific issues without custom rules for each application. Consequently, these tools are often used only by security experts or abandoned entirely. In this dissertation, I conduct an interview study of application security experts to gain an understanding of their workflows and the organizational, technical, and communication challenges they face today. From these findings, I introduce tool assisted security code review fed by interactive static analysis and interactive annotation as a solution to detect and remediate greater numbers of vulnerabilities. In this dissertation, I also explore the process, warnings, and collaboration between the various roles of users for this type of tool. Lastly, I provide a set of design guidelines for security code review tools.

Details
Author

Thomas, Tyler

Title

Security Code Review with Static Analysis Techniques for the Detection and Remediation of Security Vulnerabilities

Physical Description

1 online resource (203 pages) : PDF

Date

2018

Degree Granting Institution

University of North Carolina at Charlotte

Abstract

Security problems are both a large and growing concern today. Many security breaches are the result of security vulnerabilities introduced during the code construction phase. These vulnerabilities sometimes occur due to poor security training of the developer, and sometimes they are simply created by accident. Static analysis, examination of the application source code with a specialty tool, is the current solution to this problem. Unfortunately, this process produces an extremely large amount of false positives. It also cannot detect application specific issues without custom rules for each application. Consequently, these tools are often used only by security experts or abandoned entirely. In this dissertation, I conduct an interview study of application security experts to gain an understanding of their workflows and the organizational, technical, and communication challenges they face today. From these findings, I introduce tool assisted security code review fed by interactive static analysis and interactive annotation as a solution to detect and remediate greater numbers of vulnerabilities. In this dissertation, I also explore the process, warnings, and collaboration between the various roles of users for this type of tool. Lastly, I provide a set of design guidelines for security code review tools.

Genre

doctoral dissertations

Subjects--Topics

Computer science
Information technology

Degree

Ph.D.

Keywords

Application Security
Code Review
Information Security
Security Code Review
Software Engineering
Static Analysis

Subject Area

Computer Science

Advisor(s)

Lipford, Heather

Committee Members

Wang, Weichao
Shehab, Mohamed
Chu, Bill
Chen, Shenen

Degree Note

Thesis (Ph.D.)--University of North Carolina at Charlotte, 2018.

Rights Statement

This Item is protected by copyright and/or related rights. You are free to use this Item in any way that is permitted by the copyright and related rights legislation that applies to your use. For other uses you need to obtain permission from the rights-holder(s). For additional information, see http://rightsstatements.org/page/InC/1.0/.

Rights Holder Information

Copyright is held by the author unless otherwise indicated.

Identifier

Thomas_uncc_0694D_11788

Permalink

http://hdl.handle.net/20.500.13093/etd:1754