Title: An early detection tool in Eclipse to support secure coding practices

Authors: Benjamin White; Jun Dai; Cui Zhang

Addresses: California State University Sacramento, Sacramento, CA 95819, USA; Mother Lode Holding Company, Roseville, CA 95747, USA ' California State University Sacramento, Sacramento, CA 95819, USA ' California State University Sacramento, Sacramento, CA 95819, USA

Abstract: Developing secure software in a world where companies like Anthem Blue Cross, Twitter, Facebook, and target have had massive amounts of data stolen by hackers is as challenging as it is important. Insecure coding practices are major contributors to software security vulnerabilities. Even though several static analysis tools are available that can search for and identify security holes in software applications, this process usually runs too late and any remediation will be more costly after large portions of the software have been built. The early detection tools that do exist are closed source and utilise proprietary software vulnerability rule sets. What is missing is an open-source secure coding enforcement tool utilising well-documented rules that software developers can use to predict potential pitfalls, learn from their mistakes and aid in the construction of secure programs as they build them. To address the need, we have designed a new tool called secure coding assistant for the Eclipse development environment that semi-automates several secure coding rules set forth by the CERT division at Carnegie Mellon University. The tool detects violations of the CERT rules for the Java programming language but it is easily extensible to other languages supported by Eclipse. It is an open-source tool with an emphasis on educating software developers in secure coding practices. The tool and a tool demo is disseminated via github at http://benw408701.github.io/SecureCodingAssistant/.

Keywords: secure coding; development tool; Java; Eclipse; static analysis; education.

DOI: 10.1504/IJIPSI.2018.096142

International Journal of Information Privacy, Security and Integrity, 2018 Vol.3 No.4, pp.284 - 309

Received: 16 Sep 2017
Accepted: 07 May 2018
Published online: 13 Nov 2018 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article