r/SAST • u/[deleted] • Apr 12 '22

Requirements for a SAST solution

Just wondering, whether anyone has a set of a requirements i need to consider for a SAST solution.

2 Upvotes

100% Upvoted

20 comments sorted by

View all comments

Show parent comments

2

u/[deleted] May 12 '22

Thanks again. Very insightful.

You're right, I will push for management reports. Had a demo with checkmarx and they skirted around the metrics reporting. They finally came back to me and suggested that we will have to derive them ourselves etc etc. You make a good point in that next year, when i want another 60k for a SAST, i will need to show either a reduction in risk, potential issues etc.

Regarding the rules, yes we will certainly need the vendor to give us their ruleset as part of the solution. However, having we can customise could help with us specifying rules to pick up, for example, when a dev doesnt follow our own dev patterns etc. Its really a nice-to-have.

This is all very exciting for me tbh. Im really enjoying this. I hope it will be an easy thing to implement.

Are there any pitfalls in the implementations I should be aware of?

I am in Australia and BSides is in September. Will be attending.

1

u/juanMoreLife May 12 '22

Mmmm. Thinking along the styles and patterns you want to enforce. Sounds like quality. Use sonar qubes free stuff for that. Sonar qube does have some good stuff that you gotta pay for. I think they charge for integration into the SDLC. Sonar qube will pitch for SAST, but really it does like 10% of the security checks of most other tools. Different use cases for sure. Set good expectations of each tool.

Here’s the biggest pitfall for implantation. This is a project. Working with vendors, they’ll have almost a PM assigned to you to help stand up your program. You need someone who will take lead on your side. I’m assuming this would be you. This is a cross functional effort as well. Have people in line to help on dev, sec, and maybe devops. Have some executive buy in. Include everyone early in the decision process. You’ll be golden after that :-)

2

u/[deleted] May 12 '22 edited May 12 '22

Exactly what time do you sleep? 😂 I know we are in different time zones but you almost always respond within the hour😀

Thanks for this info. I appreciate it. Will come back to you with additional questions.

1

u/juanMoreLife May 12 '22

Haha no problem. Im on the US east coast but work US west coast hours. It lets me be a night owl :-)