Software Security Analysis - Execution Phase Audit

9 years 9 months ago
Software Security Analysis - Execution Phase Audit
Code revision of a leading telecom product was performed, combining manual audit and static analysis tools. On average, one exploitable vulnerability was found for every 4000 lines of code. Half of the located threats in the product were buffer overflows followed by race condition, misplaced trust, and poor random generators. Static analysis tools were used to speed up the revision process and to integrate security tests into the overall project process. The discussion analyses the effectiveness of automatic tools for auditing software. Furthermore, the incorporation of the software security analysis into the development process, and the results and costs of the security analysis is discussed. From the initial 42 workdays used for finding all vulnerabilities, approximately 16 days were needed for finding and correcting 91,5 % of the vulnerabilities. So, proportionally small investments improve the program code security by integrating an automatic auditing tool into the ordinary execut...
Bengt Carlsson, Dejan Baca
Added 24 Jun 2010
Updated 24 Jun 2010
Type Conference
Year 2005
Authors Bengt Carlsson, Dejan Baca
Comments (0)