论文标题
增强对连续软件安全扫描的密码可部署性
Enhancing CryptoGuards Deployability for Continuous Software Security Scanning
论文作者
论文摘要
通过敏捷的开发速度的提高可能会在此过程中引入被忽视的安全步骤，其中一个示例是爱荷华州核心小组的应用程序。验证保护机密信息（例如社会保险号）的保护需要在各个层面上进行安全，并通过任何连接的应用程序提供保护。 CryptoGuard是Java的静态代码分析仪。该程序验证了开发人员不会在其应用程序中留下漏洞。该程序通过识别加密滥用（例如硬编码键，弱程序哈希和使用不安全协议）来帮助开发人员。在我的硕士论文工作中，我为改善了加密的可部署性，可访问性和可用性做出了一些重要贡献。我将CryptoGuard扩展到扫描源和编译代码，创建了实时文档，并支持双云和本地工具套件。我还为Cryptoguard创建了构建工具插件和程序援助。此外，我还分析了几项与Java相关的调查，其中包括50,000多名开发人员，并报告了现实世界中软件开发人员的最新实践。
The increasing development speed via Agile may introduce overlooked security steps in the process, with an example being the Iowa Caucus application. Verifying the protection of confidential information such as social security numbers requires security at all levels, providing protection through any connected applications. CryptoGuard is a static code analyzer for Java. This program verifies that developers do not leave vulnerabilities in their applications. The program aids the developer by identifying cryptographic misuses such as hard-coded keys, weak program hashes, and using insecure protocols. In my Master's thesis work, I made several important contributions to improving the deployability, accessibility, and usability of CryptoGuard. I extended CryptoGuard to scan source and compiled code, created live documentation, and supported a dual cloud and local tool-suite. I also created build tool plugins and a program aid for CryptoGuard. In addition, I also analyzed several Java-related surveys encompassing more than 50,000 developers and reported interesting current practices of real-world software developers.
