Toolbox

Source Code Analysis Tools: How to Choose and Use Them

Source code analysis (or static analysis) software helps keeps buggy code from seeing the light of day.

By Mary Brandel

Brown created the business case by looking to independent sources like Gartner and Burton Group for facts and figures about code vulnerability, and he also ran some reports on how much time the FAA was dedicating to patch management.

The chief scientist justified the cost of the Ounce tool by taking the total cost of the product and comparing that to the effort involved in a manual review. "With millions of lines of code, imagine how many engineers it would take to do that, and by the way, we want to do it every week," he says. "The engineers would fall down dead of boredom." ##

Mary Brandel is a freelance writer based outside of Boston.

Other stories by Mary Brandel

• Email
• Print
• Comments
• Digg This
• SlashDot

• How to Evaluate (and Use) Web Application Security Scanners
• The Vulnerability Disclosure Game: Are We More Secure?
• Who Pushed Vendors Toward Better Security?
• Broken Windows Revisited: Why Insecure Software and Security Products Hurt the Global Economy
• Software Patching: Patch and Pray