CodeScan - Code Security: is your application secure?

The Scenario: We have are looking to implement a CRM for one of our clients who was not only interested in the base functionality, and told us we could basically use whatever “secure” solution integrated the best, without limiting future integration points. The potential solutions were down to a Software As A Service (SAAS) solution or an open source downloadable one.

The Security checks available:
- To check the quality / security of the SAAS solution I could only do a web search for known vulnerabilities and ask peers (note to the world – don’t ask the vendor “how secure they are”, you will never get a straight answer).
- For the open source solution I could do the same searches but I could also run software called CodeScan by CodeScan Labs which allowed me to check the PHP open source software for security vulnerabilities that have not yet been publicly announced – and even better it allowed me to do it without knowing all the code intimately, or being an expert in the language. The differences between the search results and the CodeScan results were “very illuminating” and have now asked the SAAS vendor to provide assurances from a third party tool (suggesting CodeScan). The brilliant thing about the CodeScan tool is that it told me what was wrong with the code, down to the lines of code, so I can go and fix the open source project. This got me thinking about different ways you could use CodeScan.

Other ways to use CodeScan in your business:

• Improve your business confidence in your developers, by giving the business a way to critique the quality of code from a security stand point without creating friction.
• Check the libraries / modules you download for packages like Drupal – before you integrate them into your production system.
• A learning tool for teaching your developers to write secure code.
• Check your university assignments before you hand them in.
• For larger organisations you could use it as a part of your performance based bonus / pay.
• Checking over the copied/pasted code that developers find.
• Get a level of confidence in the code you get back from your outsourcing partners.

There is a free trial which allows you to test the current state of your software against the rule base which is kept up to date on the CodeScan servers. You can choose from a range of languages including PHP, ASP classic and .NET, SQL injection with more reportedly coming soon.

CodeScan Labs is generating new releases all the time so I’m hoping that a new user interface, reporting, more comprehensive website and some new languages, it will almost become default for developers to check the quality of their code before it gets anywhere near a public site. So far I’ve put it under the banner of a great tool that we can use to qualify and measure improvements to applications.

Regards,
Simon Collings
Solutions Manager
http://serendipityit.co.nz