Could a computer program given the source or object version of another program be used to automate testing for trapdoors/backdoors?
Is there some kind of automated scanning tool which detects threats in Open Source Java Libraries? I think the OWASP Orizon project tried to build such a tool, but it seems to be inactive for years ...
In an application security environment, I use Fortify Software's Fortify360 on a daily basis. One of my biggest hurdles is explaining the numbers (sources vs sinks) Fortify flags each location in ...
For those of you who have worked with commercial secure code review tools such as: Klocwork Coverity Armorize Fortify Checkmarx Appscan Source Edition (formerly Ounce) Or perhaps a free or ...
What are the advantages of using automated tools, as opposed to manual review? What are the disadvantages? This applies both to external blackbox vulnerability scanning, and to static code analysis. ...