Vulnerability Scanner Software Resources

Once you have obtained security and quality metrics and defects of your application, the most probably questions you will have will be some of the following: - Where should I start to improve? - How much time does it take me to repair each one of them? - Which are the optimal path and action plan to reach my quality goals? - I only have 20 hours to fix errors before the next delivery. What should I fix to aim the best possible quality? Kiuwan provides a module to create Action Plans, i.e. a concrete and defined set of goals and actions to be performed on your application. Once defined, you will be able to share it (by exporting to PDF or as Jira issues) and track progress based on analysis results. In order to create an Action Plan, you can follow two different approaches.

Kiuwan provides indicators for: Software characteristics Security, efficiency, maintainability, reliability and portability Global Indicator It is calculated as weighted average of the above software characteristics through a complex algorithm that has into account the severity of the defects, the weight of the category in which the defect is, the analyzed code volume and the criticality of the language for Kiuwan user. Kiuwan allows to “customize” this algorithm by modifying its level of demand, the weights of the category and the priority of the rules. Effort to Target The amount of work effort needed to reach the defined goal. Objectives are defined at application level. These objectives are configurable. CQM has a repair effort assigned for each one of the more than 4,000 rules it incorporates. The sum of the repair efforts of each defect indicates the time needed to reach the targets. Risk Index It is a summary index that concentrates all evidence found in the application source code and could be understood as the risk associated to the software defects found related to defined goals and effort to reach them. See below for further details.

Kiuwan provides out-of-the-box "rules" to accomplish your applications security and quality with industry standards, such as CWE, OWASP, CERT-Java/C/C++, SANS-Top25, WASC, PCI-DSS, NIST, MISRA, BIZEC, ISO/IEC 25000 and ISO/IEC 9126. Please visit our blog post on Security standards in software development: https://www.kiuwan.com/blog/security-standards-in-software-development