ToorCon 21 - STATIC CODE ANALYSIS SHOULD WORK FOR DEVELOPERS NOT FOR YOU - Aravind Sreenivasa
Channel: ToorCon
Date: 2019-12-09

Most commercial static analysis tools today are generic and ineffective. They are not devel- oper oriented as they are built for security professionals. In this presentation, we’ll discuss how we made the process developer friendly by building a code analysis platform that pro- vides relevant findings during code review, with the help of open source static analysis tools.
Most of the commercial static analysis tools today are generic, full of false positives, and are unfriendly to developers. These products try to cover every language, vulnerability type, and environment in every company. To appear effective, they focus on finding a long list of vulnerabilities that are only comprehensible to the security team. This exhaustive collection of low quality bugs doesn’t inspire developers to use the results to improve their code's security.
In this presentation, we’ll discuss how we made the process developer friendly. We built a static code analysis platform that only provides relevant findings during code review. We constantly improve the platform by adding custom tools through a plug-in model and by enhancing finding accuracy through triage and developer feedback. Finally, we’ll illus- trate how this approach is a feasible option for companies of any size.
This session is ideal for blue team members passionate about making security developer friendly. Let’s discuss how to make static analysis more than just security theater.

aRavind sReenivasa

Aravind Sreenivasa is an Application Security Engineer at DocuSign. He started his career as a software developer and transitioned to security after obtaining a graduate degree in computer science. Aravind is passionate about making security developer friendly and integrating security with the software development process.