[Dailydave] Static and Dynamic Analysis

Dave Aitel dave.aitel at gmail.com
Mon Feb 11 18:57:53 UTC 2019


So one thing I often find weird about our industry is how it gets taken
over by marketing language and the utility of entire classes of products
gets clouded over. For example, part of any SDLC is going to be static and
dynamic analysis. However, if you ask a normal security manager what kinds
of bugs these sorts of products find or don't find, and what the false
positive levels are, they find it hard to answer, even assuming they use
them.

What I'm trying to do with INFILTRATE's Java Hacking
<http://infiltratecon.com/training/> class is get access to a modern static
analysis tool and be able to plug the class exercises into it. This way,
not only do you have a corpus of "Correct" vulnerabilities, but you get to
see what it looks like through the "Source-to-sink" algorithms, and how to
tell true positives from false positives, and also examine false negatives.

Likewise, judging a static analysis tool is often about figuring out where
they set their dial. When you talk to the Chris's they will say they have
VERY LOW false positives, which is never my experience with any tool in
this area. But you can dial UP the false negatives to get lower false
positives for any tool like this. BUT DO YOU WANT TO? These are important
trade off questions that need to be examined in the wild as opposed to
through marketing.

Anyways, sign up for the class, because it is a great class, and this may
be the first time anyone has done a corpus test on a static analysis tool
during class. :)

-dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.immunityinc.com/pipermail/dailydave/attachments/20190211/de781ec6/attachment.html>


More information about the Dailydave mailing list