Source Code Analysis Laboratory (SCALe) for Energy ... - CERT

More documents

Recommendations

Info

Figure 6: CERT SCALe Seal Except for patches that meet the criteria below, any modification of software after it is designated as conforming voids the conformance designation. Until such software is retested and determined to be conforming, the new software cannot be associated with the CERT SCALe seal. Patches that meet all three of the following criteria do not void the conformance designation: • The patch is necessary to fix a vulnerability in the code or is necessary for the maintenance of the software. • The patch does not introduce new features or functionality. • The patch does not introduce a violation of any of the rules in the secure coding standard to which the software has been determined to conform. Use of the CERT SCALe seal is contingent upon the organization entering into a service agreement with Carnegie Mellon University and upon the software being designated by CERT as conforming. 3.3 CERT SCALe Service Agreement Organizations seeking SCALe conformance testing will abide by the SCALe policies and procedures required by the SCALe Service Agreement. Organizations submitting software code for conformance testing will follow these basic processes: 1. A service agreement must be fully executed by the organization and Carnegie Mellon University’s Software Engineering Institute before conformance testing begins. 2. CERT evaluates the source code of the software against the identified CERT secure coding standard(s), specified in the statement of work, using the identified tools and procedures and provides an initial conformance test report to the client that catalogues all rule violations found as a result of the SCALe evaluation. 3. From receipt of the initial conformance test report, the client has 180 days to repair nonconforming code and/or prepare documentation that supports the conclusion that identified violations do not present known vulnerabilities and resubmit the software and any deviation requests for a final evaluation of the software against the specified CERT secure coding standard(s). CMU/SEI-2010-TR-021 | 30
4. CERT will evaluate any deviation requests and reevaluate the software against the specified CERT secure coding standard(s) and provide a final conformance test report to the client. 5. Clients are permitted to use the CERT SCALe seal on their website in connection with successful product conformance testing after the product version has passed the applicable conformance test suite(s). Clients may describe the product version as having been determined by CERT to conform to the CERT secure coding standard. 6. Clients whose software passes the conformance testing agree to have their product version listed on the CERT web registry of conforming systems. 3.3.1 Conformance Certificates SCALe validation certificates include the client organization’s name, product name, product version, and registration date. Certificates also include a list of applicable guidelines and an indication if, for a particular guideline, the source code being tested was determined to be provably conforming or conforming. Register of Conforming Products CERT will maintain an online certificates registry of systems that conform to CERT secure coding standards at https://www.securecoding.cert.org/registry. 3.4 SCALe Accreditation CERT will not initially seek American National Standards Institute (ANSI), International Organization for Standardization (ISO), or NIST accreditation for SCALe from an accreditation agency. However, CERT will endeavor to implement processes, procedures, and systems that comply with national and international standards. As needed, the program can submit for accreditation by the following agencies: • ISO/IEC. This agency has published ISO/IEC 65, which provides principles and requirements for the competence, consistency, and impartiality of third-party certification bodies evaluating and certifying products (including services) and processes. This standard is under revision and is scheduled to be released as 17065 in July of 2011. The agency has also published ISO/IEC 17025:2005 General Requirements for the Competence of Testing and Calibration Laboratories, which specifies the requirements for sound management and technical competence for the type of tests and calibrations SCALe undertakes. Testing and calibration laboratories that comply with ISO/IEC 17025 also operate in accordance with ISO 9001. • NIST National Voluntary Laboratory Accreditation Program (NVLAP). NVLAP provides third-party accreditation to testing and calibration laboratories. NVLAP’s accreditation programs are established in response to Congressional mandates, administrative actions by the federal government, and requests from private-sector organizations and government agencies. • NVLAP operates an accreditation system that is compliant with ISO/IEC 17011:2004 Conformity assessment. It provides general requirements for bodies accrediting conformance assessment bodies, which requires that the competence of applicant laboratories be assessed by the accreditation body against all of the requirements of ISO/IEC 17025: 2005 General requirements for the competence of testing and calibration laboratories. CMU/SEI-2010-TR-021 | 31
Page 1 and 2: Source Code Analysis Laboratory (SC
Page 3 and 4: Table of Contents Acknowledgments v
Page 5 and 6: List of Figures Figure 1: SCALe Pro
Page 7 and 8: List of Tables Table 1: True Positi
Page 9 and 10: Acknowledgments We would like to ac
Page 11 and 12: Abstract The Source Code Analysis L
Page 13 and 14: 1 Introduction A key mission of the
Page 15 and 16: 1. Client contacts CERT. The prooce
Page 17 and 18: • The CERT C++ Secure Coding Stan
Page 19 and 20: • A floating-point value with all
Page 21 and 22: 2 Conformance Testing This section
Page 23 and 24: Figure 4: SCALe Conformance Tesstin
Page 25 and 26: • De-duplication of crashing test
Page 27 and 28: Handbook of Applied Acceptance Samp
Page 29 and 30: 2.6 Tracking Diagnostics Across Cod
Page 31 and 32: _Pragma(push: tool_a_maybe_foo, dis
Page 33 and 34: processes. A system of review will
Page 35 and 36: diagnostic codes mapped to a repres
Page 37 and 38: ID Rule Group AA AC 1 AC 2 AC 3 AC
Page 39 and 40: lack of confidence with C++. Howeve
Page 41: 3.1.1 Impartiality CERT resides wit
Page 45 and 46: Table 6: Flagged Nonconformities, E
Page 47 and 48: Table 8: Flagged Nonconformities, E
Page 49 and 50: 4 Related Efforts This section desc
Page 51 and 52: 5 Future Work and Summary 5.1 Futur
Page 53 and 54: Bibliography URLs are valid as of t
Page 55 and 56: [MISRA 2004] Motor Industry Softwar
Page 57: REPORT DOCUMENTATION PAGE Form Appr

Source Code Analysis Laboratory (SCALe) for Energy ... - CERT

Create successful ePaper yourself

Delete template?

Save as template?