devopsy.kinsta.cloud

Tag: GrammaTech

  • GrammaTech Adds SBOM Analysis Capability to CodeSentry

    GrammaTech Adds SBOM Analysis Capability to CodeSentry

    GrammaTech today updated its CodeSentry code inspection platform to include the ability to create a software bill of materials (SBOM) by analyzing application binaries.

    Walter Capitani, director of technical product management for GrammaTech, said version 3.0 of CodeSentry leverages the algorithms the company uses for binary software composition analysis to enable organizations to better address software supply chain concerns in the wake of a series of high-profile vulnerabilities.

    The tool can be applied to both commercial software and open source components via integration with Risk Based Security’s VulnDB database, created to track security issues.

    GrammaTech

    There is more focus than ever on creating SBOMs in the wake of the Biden administration’s recent executive order that will require federal agencies to only use software that comes with an SBOM. However, most organizations are not provided with access to the source code used within the applications they employ. GrammaTech enables organizations to address that issue by analyzing the binary code within an application to generate an SBOM.

    That report not only identifies all the components in an application, it also lists all known vulnerabilities associated with the version of the components being employed, said Capitani. CodeSentry will also list other common software products and the versions that may be impacted by the same vulnerabilities, along with versions of the software that have remediated the issue or versions of a component that have not been impacted by those vulnerabilities.

    Almost all software applications include third-party and open source components that create blind spots within software supply chains. In fact, that issue is what makes remediating zero-day application vulnerabilities so challenging; especially when they are discovered in, for example, a log management tool like Log4j that is widely used in Java applications.

    GrammaTech is making a case for a binary software composition analysis (SCA) tool that enables DevOps teams to address vulnerability issues prior to an application being deployed in a production environment. At the same time, however, security and compliance teams can now use the same tool to determine the level of risk an organization might be incurring once an application is deployed in production. That latter capability is especially critical because zero-day vulnerabilities are often not discovered until long after an application is deployed in a production environment, noted Capitani.

    Regardless of approach, the need to better secure software supply chains is now a major IT issue that should ultimately encourage more organizations to adopt DevSecOps best practices to better secure applications. The challenge, of course, is not just espousing the need for those practices but also providing developers with tools they will actually use to implement those practices. The success or failure of those efforts comes down to not just the efficacy of the tool but also how well it fits within the overall developer experience. After all, the greatest tool in the world will still languish if it’s too difficult for the average developer to employ.

  • GrammaTech Allies with GitLab to Advance DevSecOps

    GrammaTech Allies with GitLab to Advance DevSecOps

    GrammaTech announced today it has partnered with GitLab to integrate its GrammaTech CodeSonar static application security testing (SAST) tools with the GitLab Ultimate DevSecOps platform.

    Vince Arneja, chief product officer at GrammaTech, said integration with continuous integration/continuous delivery (CI/CD) platforms such as GitLab is critical because it enables security scans to run automatically any time code is merged. That capability reduces the amount of code that is scanned at any one time, Arneja said.

    GrammaTech is partnering with multiple CI/CD platforms and integrated development environment (IDE) providers to make it simpler to create multiple points for scanning code during the application development process, Arneja noted.

    GitLab, meanwhile, is providing its own tools for analyzing artifacts as they move through the software development life cycle. The GrammaTech tools, available via the highest tier level made available by GitLab, analyze code at a deeper level, said Arneja.

    Ultimately, the goal is to enable developers to discover security flaws as early as possible in the application development life cycle. The later those flaws are discovered, the more expensive they become to fix, Arneja said.

    Developers, naturally, tend to postpone security scans as they race to meet an application deadline. That practice creates issues; the more code there is to analyze, the longer such scans take. It’s generally more efficient to scan smaller amounts of code more frequently. Otherwise, developers can become overwhelmed by the number of security bug fixes that need to be addressed at the back end of the application development process. Automating security scans allows an organization to move toward embracing DevSecOps best practices in a way that doesn’t rely on a developer remembering to initiate a scan.

    Most developers are not deliberately ignoring security issues – it’s just that the existing, manual processes for discovering those flaws is inefficient.

    Automated scans also provide the added benefit of simplifying discovery of common security flaws long before a code review, creating more time to address significantly more complex issues.

    Application development teams are also under pressure to reduce the total number of bugs that need to be fixed after an application is deployed. As the number of applications being deployed steadily increases, developers can find themselves spending more time fixing bugs than writing new application code.

    Most organizations are not very far along in their journey toward embracing DevSecOps. However, as it becomes easier to integrate a variety of scanning tools within DevOps workflows, the number of organizations moving up the DevSecOps maturity curve should increase. In the wake of some recent, high-profile attacks on software supply chains, the sense of urgency surrounding the adoption of DevSecOps best processes has undoubtedly increased.

    In the longer term, there may soon come a day when security is viewed as just one of many quality assurance gates that code needs to pass through before it’s allowed to be promoted. In the meantime, an ounce of cybersecurity prevention at the front end of any application development is most certainly going to be worth more than several pounds of cybersecurity cure applied too late.

  • DARPA Enlists GrammaTech to Apply AI to Reverse Engineer Code

    DARPA Enlists GrammaTech to Apply AI to Reverse Engineer Code

    The Defense Advanced Research Projects Agency (DARPA) has awarded a research contract to GrammaTech for low code technology that will make it possible for end users to leverage artificial intelligence (AI) without requiring intervention from the original software developer.

    GrammaTech’s AI tool, dubbed ReMath, aims to ease application updates by automatically inferring high-level mathematical representations from existing binaries in systems and embedded software. The tool is currently in development.

    Dr. Alexey Loginov, vice president of research for GrammaTech, said development teams spend a lot of time using low-level tools such as disassemblers, debuggers and decompilers to manually analyze binaries. ReMath will accelerate that reverse engineering process by recovering and converting machine language into representations that end users can directly manipulate, said Loginov.

    The goal is to free developers up to build new software, rather than continuously updating software that has already been deployed, noted Loginov. This approach should ultimately reduce the backlog of application and software development projects organizations have, added Loginov.

    GrammaTech

    The ReMath project is the latest in a series of DARPA contracts awarded to GrammaTech. In general, the company is working towards applying AI to advance DecSecOps via a static application security testing (SAST) tool that identifies vulnerabilities in code. The ReMath project focuses on applying AI to use cases involving, for example, industrial control systems. These systems could benefit from allowing domain experts, with no coding expertise, to maintain and update them on their own, said Loginov.

    Other DARPA projects GrammaTech is actively researching include a type-ahead capability that automatically recognizes existing artifacts in a software repository, said Loginov. This capability will make it simpler for developers to reuse code within the context of a GitOps process without inadvertently introducing additional errors, Loginov said.

    In the future, the potential impact of AI on software development could be profound, as more reliable code moves into production environments. The percentage of code graduating into those environments on the first attempt should increase considerably in the years ahead. That should enable more reliable delivery of application code via continuous integration/continuous delivery (CI/CD) platforms.

    As software development becomes more efficient, the current developer shortage should also ease, and open up resources to launch a greater number of application development projects. Rather than spending time on manual tasks that provide no differentiated value, Loginov said software engineers will be able focus more of their time and energy on process innovation.

    In the meantime, developers should expect to see a rash of development tools with AI capabilities in the months ahead. None of those tools are likely to eliminate the need for developers any time soon; however, much of the drudgery involved in writing code today is likely to be sharply reduced as machine learning algorithms and other forms of AI are applied to software development.