SAST - Static Application Security Testing
Static Reviewer and Quality Reviewer, released in the Security Reviewer Suite, are provided both On Premise (Desktop, CI Plugins, Maven / Gradle / SBT / SonarQube Plugins, Ant Task and CLI Interface tested with many CI/CD platforms) and in Cloud (as Virtual Desktop or REST API Server), as Container (Docker, Kubernetes, OpenShift or any other APPC-compliant), executes code checks according most relevant Secure Coding Standards for commonly used Programming Languages. It offers a unique, full integration between Static Analysis (SAST), Agent-based Analysis (IAST) and DAST (Dynamic) analysis, directly inside Programmers IDE.
...
Jenkins and Bamboo Plugins are part of Security Reviewer Suite.
A CLI Interface is also provided, both for Static Analysis and Software Composition AnalysisJenkins and Bamboo Plugins rely on user's infrastructure to run and support the respective platforms.
...
Using built-in design 9000+ validation rules, during Code Review process it can highlight violations and even suggest changes that would improve the structure of the system. it creates an abstract representation of the program, based on Dynamic Syntax Tree own patented algorithm.
...
| Anchor | ||||
|---|---|---|---|---|
|
The Rule Engine rule engine, with its internal multi-thread , - optimized state - machine based on on Dynamic Syntax Tree, is the fastest in the market, 52x faster than competitors. It does not need any internal or external RDBMS to run, and it is fully extensible via XML. Its unique capability to reconstruct an intended layering, makes it an invaluable tool for discovering the architecture of a vulnerability that has been injected in the source code, with very rare cases of False Positives. Jenkins and Bamboo Plugins rely on user's infrastructure to run and support fully-scalable Jenkins and Bamboo platforms running on the following
Static Reviewer supports running in the below listed infrastructures:
Hosts
CentOS 7/8
Microsoft Windows 10/2008/2012/2016/2019
Ubuntu 16.04/18.04/19.04/19.10/20.04 both server and desktop
Fedora 21 or newer
SuSE Linux Enterprise 12 or newer
RedHat RHEL 7 or newer
Mac OSx 10.11 “El Capitan” or newer
...
Oracle VirtualBox 6.0.0 or newer
Microsoft Hyper-V for Windows 10/2008/2012/2016/2019
Red Hat Enterprise Virtualization 3.6 or newer
KVM (Kernel-based Virtual Machine) kvm-44 or later
Containers Platforms
SCM Integrations
You can directly checkout (push) source code from the following SCM platforms:
SubVersion (SVN)
IBM Rational ClearCase
Perforce
Mercurial
AccuRev
The source code will be stored temporary in an encrypted folder and loaded in a secure buffer.
Analysis Results can be stored in the above SCM platforms.
You can do that using our Jenkins plugin or directly from our Desktop app.
CI/CD Platforms Integrations
...
Cloud Platforms supported (CI Plugins):
File Servers
All our products can work accessing files on local file system, as well as the following File Sharing Systems:
Network File System (NFS)
Samba
FTP, TFTP, SFTP, FTP-S
UNC Paths
Permalinks
Relational Databases
Static Reviewer does not need RBDMS to run, and it is fully extensible via XML. It is able to analyze SQL code written on different SQL Dialects.
Our unified Dashboard, named Team Reviewer supports (configurable) the following RDBMS:
Oracle MySQL 5.6 or higher
Oracle Database RAC 12 or newer
Microsoft SQL Server 2012 or newer
PostgreSQL 9.0 and higher
Alpine H2 1.4.196 or newer
MariaDB 10.x
System Requirements
Desktop
...
Requests and Responses log. Our CI Plugins rely on your CI Platform for this kind of logging. See: https://jenkins.io/doc/pipeline/steps/http_request/ and https://confluence.atlassian.com/bamboo/logging-in-bamboo-289277239.html
Audit log. Our CI Plugins rely on your CI Platform for this kind of logging. See: https://plugins.jenkins.io/audit-log and https://confluence.atlassian.com/bamboo/logging-in-bamboo-289277239.html
Application log. Our Ci Plugin write XML cloned as plain-text in the current CI Workspace, using slf4j. Further the application log is written in the standard CI Console Output
Access log. See https://wiki.jenkins.io/display/JENKINS/Access+Logging and https://confluence.atlassian.com/bamboo/logging-in-bamboo-289277239.html
Vulnerability detection log. Two Vulnerability logging ways are provided: Inside Application log (see above) and a separate XML log in the current CI Workspace, using slf4j
The above logs are customizable according the customer needs.
| Anchor | ||||
|---|---|---|---|---|
|
...
C#, Vb.NET, VB6, ASP, ASPX, Java, JSP, JavaScript (client side & server side), TypeScript, Java Server Faces, Ruby, Python, R, GO, Clojure, Groovy, Flex, ActionScript, PowerShell, Rust, LUA, Auto-IT, HTML5, XML, XPath, C, C++ (see C/C++ Options), PHP, SCALA,, IBM Streams Processing Language, Shell (bash, sh, csh, ksh), BPMN, BPEL, PowerBuilder, COBOL (see COBOL Options), JCL, RPG, PL/I, ABAP, SAP-HANA
...
Supported Libraries and Frameworks (Static Analysis):
JAVA: 146 Frameworks
https://en.wikipedia.org/wiki/List_of_Java_Frameworks
...
Parameters: Parameters in Naive Bayes are the estimates of the true distribution of whatever we're trying to classify. The variables your algorithm is trying to tune to build an accurate model..
Classifier: Classifiers are also referred to group of attributes. .
...
Security Reviewer uses Blockchain to publish anonymous Effort Estimation data, under permission of voluntary organizations using our products. It maintains a repository of data from numerous organizations' completed software projects. In particular, the repository has provided research data on several topics, including APPW metrics, COCOMO, COSMIC, SLOC, LLOC, WMC, Cyclomatic Complexity, Technical Debt, Function Points, Country, Industry, Application Type, Project duration, and Cost estimation. A software benhmarking experiment performed by Security Reviewer determined whether using anonymous data provides any valuable information to an organization. The organization's completed projects are compared to similar projects in a Blockchain to establish averages for the organization and the industry as a whole. A critical aspect of the repository is confidentiality. Each organization is represented by a code (for example, “contributed by Organization X”) so that Security Reviewer can identify projects without revealing the organization itself. Codes are not available to the public.
CI PLUGINS
Security Reviewer Static Analysis
...
Software Composition Analysis Desktop, Jenkins and Bamboo native plugins and CLI Interface (test on many CI/CD platforms) provide a 360 degrees solution covering all your DevOps needs. 3rd-party libraries can be analyzed (Open Source Analysis-OSA) using a shared folder located on Network File System (NFS), a Nexus Repository or JFrog Artifactory for discovering Vulnerable Libraries, Vulnerable Frameworks, Blacklisted/ Discontinued/ Outdated / Obsolete/ Deprecated libraries and frameworks. Legal issues like: Blacklisted Licenses, Licenses Conflict, No-licensed libraries, Suspicious (modified) licenses and Poor-man Copyrights are fully-detected from the tool.
...
Security Reviewer SCA can publish results to a bunch of Dashboards like: OWASP Dependency Track, Kenna Security, CodeDx, Micro Focus Fortify SSC, SonarQube and ThreadFix, as well as to your preferred Defect Tracker (JIRA, BugZilla, etc.).
...
COPYRIGHT (C) 2014-2021 SECURITY REVIEWER SRL. ALL RIGHTS RESERVED.