2KKUU7ita

304
Part V: Hacking Applications
CxDeveloper is pretty much all you need to analyze and report on vulnerabilities
in your C#, Java, and mobile source code bundled into one simple
package. Checkmarx, like Veracode, also offers a cloud-based source code
analysis service. If you can get over any hurdles associated with uploading
your source code to a third party in the cloud, these can offer a more efficient
and mostly hands-free option for source code analysis.
Source code analysis will often uncover different flaws than traditional web
security testing. If you want the most comprehensive level of testing, do both.
The extra level of checks offered by source analysis is becoming more and
more important with mobile apps. These apps are often full of security holes
that many newer software developers didn’t learn about in school. I cover
additional mobile flaws in Chapter 10.
The bottom line with web security is that if you can show your developers
and quality assurance analysts that security begins with them, you can really
make a difference in your organization’s overall information security.