Title :
Supply chain risk management - Understanding vulnerabilities in code you buy, build, or integrate
Author_Institution :
CSC, King George, VA, USA
Abstract :
This paper describes the scope of the problem regarding software vulnerabilities and the current state of the practice in static code analysis for software assurance. Recommendations are made regarding the use of static analysis methods and tools during the software life. Static code analysis touch points in during life cycle reviews and challenges to automated static code analysis are also discussed.
Keywords :
risk management; software management; supply chain management; automated static code analysis; software assurance; software life; software vulnerabilities; supply chain risk management; Documentation; Inspection; Manuals; Schedules; Security; Software; Supply chains; code analysis; code analysis tools; life cycle; security; security risk management; software assurance; software engineering; static code analysis; system assurance; systems engineering; vulnerabilities; weaknesses;
Conference_Titel :
Systems Conference (SysCon), 2011 IEEE International
Conference_Location :
Montreal, QC
Print_ISBN :
978-1-4244-9494-1
DOI :
10.1109/SYSCON.2011.5929123
