Static Code Analysis

Static code analysis involves reviewing the application’s source code to find security vulnerabilities, coding errors, and weaknesses without executing the code. This helps in identifying flaws early in the development process.

Testing Standards:

• CWE (Common Weakness Enumeration)
• CERT Secure Coding Standards

Tools:

• SonarQube: For static code analysis and code quality checks.
• Fortify SCA: Static application security testing (SAST) tool.
• Checkmarx: For scanning source code for vulnerabilities.

Techniques:

• Static analysis with security rulesets
• Identifying hard-coded credentials, insecure cryptography, and input validation issues
• Reviewing coding patterns against security best practices