SQL Injection Attacks and Defense - 2009

Reviewing Code for SQL Injection • Chapter 3 131
Remember the old proverb: “A bad workman always blames his tools”! In these
situations, it may be easy to blame the tool for failing to deliver. However, this is not
the case. You should never rely on just one tool, and instead should leverage multiple
tools and techniques during the development life cycle. In addition, multiple
experienced and knowledgeable individuals should perform audits at different
stages of the project to provide assurances that implemented processes and procedures
are being followed. Developers shouldn’t be reprimanded harshly; instead, they should
be given constructive feedback and education where necessary so that they learn from
the process and ultimately produce more secure code. Code analysis tools should be
used as guidelines or preliminary benchmarks as opposed to definitive software
security solutions.
Ounce
The Ounce toolset is a collection of several components. The Security Analyst component
parses source code into what it calls a Common Intermediate Security Language (CISL).
The SmartTrace component graphically represents how data flows through vulnerable code;
vulnerabilities can then be assigned to self-contained “bundles” which are then passed along
to developers to fix. Developers open these bundles using the Ounce Developer plug-in for
Visual Studio or Eclipse. The bundle includes all relevant information about the vulnerability,
including SmartTrace graphs and remediation advice. The tool also generates application
audit metrics for management reports.
■■
■■
■■
■■
■■
URL: www.ouncelabs.com
Languages: Java, JSP, C, C++, C#, ASP.NET, VB .NET, JavaScript,
classic ASP/VBScript, and Visual Basic 6
Platforms: Windows, Solaris, Linux, and AIX
IDEs: Microsoft Visual Studio and Eclipse
Price: Contact to request quote
Fortify Source Code Analyzer
Source Code Analyzer is a static analysis tool that processes code and attempts to identify
vulnerabilities. It uses a build tool that runs on a source code file or set of files and converts
the file(s) into an intermediate model that the company optimizes for security analysis.
This model is put through a series of analyzers (data flow, semantic, control flow,
configuration, and structural). Source Code Analyzer also uses Secure Coding Rule Packs to
analyze the code base for violations of secure coding practices.