Overview
The full Secure SDLC scanning model clearly shows that your organization has matured and is taking responsibility by practicing secure coding throughout the coding stage.
By scanning the code as it is being developed, the organization can expect some major benefits:
- Fixing fewer findings as the code is being developed. Once ready for release, projects will have fewer issues to fix in preparation for production.
- Integrating security seamlessly within the development environment – the SAST tool allows developers to integrate security as part of their code development process. In turn, allowing developers to consider security as an additional practice within the SDLC rather than an external burdensome task.
- By providing a SAST tool for developers to use, a steep learning curve is often achieved, as they tend to better understand the security vulnerabilities and their causes, as well as how to avoid them in the future.
- The majority of technical vulnerabilities can be easily detected and fixed during the coding stage. This results in fewer complex and business logic issues for regulatory audits or penetration testing (if practiced).
Checkmarx Secure SDLC Architecture
Some of the recommended distributed scanning basics:
- Train the trainers; power users on each development team. Once they will have the knowledge, they will be able to run scans, review results and provide support to their respective teams.
- Train the developers and make sure they are comfortable with the scanned vulnerabilities, as well as with the tool and the way results are presented.
- Build a clear process and security policy, so that developers understand what is expected from them; when and what to scan, and what to do with the findings, etc.
- Gradually deploy the developers UIs, adding a few teams at a time.
