Search papers, labs, and topics across Lattice.
This paper introduces an automated process that integrates Static Application Security Testing (SAST) tool outputs into developers' existing issue-tracking systems within CI/CD pipelines, addressing usability barriers that have limited SAST adoption. By implementing this process with the SonarQube tool in a GitLab environment, the authors demonstrate improved identification and communication of security vulnerabilities, leading to enhanced remediation efforts. The results indicate that while there are challenges such as learning curves and workflow disruptions, the overall impact significantly boosts security awareness and responsiveness among developers.
Automating SAST integration into CI/CD pipelines can transform how developers manage security vulnerabilities, significantly enhancing their responsiveness and awareness.
In the contemporary landscape of software devel-opment, securing sensitive data is paramount to safeguarding organizational reputation, preventing financial losses, and pro-tecting individuals from identity theft. This paper addresses the pervasive challenge of identifying and rectifying security vulnerabilities early in the development process, emphasizing the role of Static Application Security Testing (SAST) tools. While SAST tools play a crucial role in detecting vulnerabilities, widespread adoption has been hindered by usability issues, including high false positive rates and a lack of native pipeline support. This paper proposes a novel, generalized, and automated process for aggregating SAST tool outputs and integrating them into developers' familiar issue-tracking software. The process streamlines the identification and communication of security vulnerabilities during the development lifecycle, facilitating more efficient remediation efforts. We demonstrate the successful implementation of the proposed process with the SonarQube SAST tool in a GitLab-based development environment. Developers were positive about the structured implementation, real-time feedback, and proactive vulnerability management. However, despite some challenges such as a potential learning curve and tradeoffs between secure coding and workflow disruption, the overall positive impact on security awareness and responsiveness suggests that the proposed process holds promise in enhancing the security posture of software development practices
