Real World Static Analysis For Real Humans
summary
Evaluates six vendors because Scala support is nonnegotiable, benchmarks tools against 46 known vulnerable samples, and targets roughly 20% false positive noise by disabling noisy rules and adding custom ones. Builds a translation/runner stack: Fortnite for builds and translation, CloudFort to emulate cloud workers and enable safe autoscaling, Fort Squire to sync results into Jira, and FortWatch to publish queue-to-worker ratios as AWS custom metrics; uses AMIs, RPMs and Terraform to reproduce the pipeline.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 0:33Target Audience
- 1:57Selecting a Core
- 4:22Predefined Criteria
- 5:24Application Samples
- 7:01Automated Pipeline
- 12:19VP Architecture
- 13:19Scanning Pipeline
- 14:40Dependencies
- 15:17Metadata
- 18:18Phase 1 Architecture
- 19:36FordSquire
- 21:16Scaling
- 22:58Race Conditions
- 24:15CloudFort
- 25:04Undocumented API
- 26:38Job Claim
- 31:11Parallel Scanning
- 33:43Single Threaded
- 36:47Fortified
- 38:25CloudWatch
- 40:24New Architecture
- 41:26Fusion
- 42:18FortSquire
- 44:35Deployment Pipeline
- 44:58IMAS
- 47:56What Next
- 49:00How Static Analysis Works
related talks
54mA Shock to the System Static Analysis for Real AppSec
33mBattle Tested Application Security
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
44mUsing Static Analysis Tools to Become A Superhero Programmer
35mKnow Your Tools: Quirks And Flaws, Integrating SAST Into Your Pipeline
40mChoosing The Right Static Code Analyzers Based On Hard Data
34mKeep your code safe during the development path using OS tools
54mKeeping your code secure