供应链风险管理——了解您购买、构建或集成的代码中的漏洞

2011 IEEE International Systems Conference Pub Date : 2011-04-04 DOI:10.1109/SYSCON.2011.5929123

P. Croll

{"title":"供应链风险管理——了解您购买、构建或集成的代码中的漏洞","authors":"P. Croll","doi":"10.1109/SYSCON.2011.5929123","DOIUrl":null,"url":null,"abstract":"This paper describes the scope of the problem regarding software vulnerabilities and the current state of the practice in static code analysis for software assurance. Recommendations are made regarding the use of static analysis methods and tools during the software life. Static code analysis touch points in during life cycle reviews and challenges to automated static code analysis are also discussed.","PeriodicalId":109868,"journal":{"name":"2011 IEEE International Systems Conference","volume":"70 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2011-04-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"4","resultStr":"{\"title\":\"Supply chain risk management - Understanding vulnerabilities in code you buy, build, or integrate\",\"authors\":\"P. Croll\",\"doi\":\"10.1109/SYSCON.2011.5929123\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"This paper describes the scope of the problem regarding software vulnerabilities and the current state of the practice in static code analysis for software assurance. Recommendations are made regarding the use of static analysis methods and tools during the software life. Static code analysis touch points in during life cycle reviews and challenges to automated static code analysis are also discussed.\",\"PeriodicalId\":109868,\"journal\":{\"name\":\"2011 IEEE International Systems Conference\",\"volume\":\"70 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2011-04-04\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"4\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2011 IEEE International Systems Conference\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/SYSCON.2011.5929123\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2011 IEEE International Systems Conference","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/SYSCON.2011.5929123","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 4

摘要

本文描述了软件漏洞问题的范围和软件保障静态代码分析实践的现状。建议在软件生命周期中使用静态分析方法和工具。本文还讨论了生命周期评审中的静态代码分析接触点以及自动化静态代码分析面临的挑战。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文

微信好友朋友圈 QQ好友复制链接

本刊更多论文

Supply chain risk management - Understanding vulnerabilities in code you buy, build, or integrate

This paper describes the scope of the problem regarding software vulnerabilities and the current state of the practice in static code analysis for software assurance. Recommendations are made regarding the use of static analysis methods and tools during the software life. Static code analysis touch points in during life cycle reviews and challenges to automated static code analysis are also discussed.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

2011 IEEE International Systems Conference

自引率

0.00%

发文量