Security

Static, Dynamic, Software Composition, and Secret Scanning in GitHub

Static Application Security Testing (SAST)

SAST tools analyze source code to detect security vulnerabilities. They are typically used early in the development process.

• GitHub Advanced Security: GitHub's built-in SAST solution, CodeQL, offers a powerful engine for scanning your source code for vulnerabilities. It's integrated with GitHub Actions, enabling automated scanning on every push or pull request.
• SonarQube: A popular open-source SAST tool, SonarQube can be integrated with GitHub through its SaaS version, SonarQube Cloud, or self-hosted instances. It provides a comprehensive range of security checks and integrates with GitHub's pull request workflow.
• Veracode: Provides SAST solutions that can be integrated into the CI/CD pipeline. It supports multiple programming languages and frameworks.
• Checkmarx: Known for its high accuracy in identifying vulnerabilities and providing actionable insights. It integrates seamlessly with various development tools and environments.
• Fortify: HP Fortify offers static code analysis, identifying security vulnerabilities in code early in the development process.

Dynamic Application Security Testing (DAST)

DAST tools analyze applications in their running state to find vulnerabilities that might be exploited.

• OWASP ZAP (Zed Attack Proxy): An open-source tool ideal for automated and manual security testing of web applications.
• Acunetix: Known for its fast scanning capabilities and comprehensive vulnerability detection, including SQL injection and XSS.
• Netsparker: Automatically verifies the identified vulnerabilities, reducing the number of false positives.

Software Composition Analysis (SCA)

SCA tools help in identifying open-source components in your software and any associated vulnerabilities.

• WhiteSource: Offers comprehensive SCA capabilities, including detection of vulnerable open-source components and license compliance issues. Open-source and SaaS versions.
• Snyk: Specializes in open-source vulnerability management, providing real-time alerts and remediation advice. Commercial version with free community plan.
• Black Duck by Synopsys: Identifies open-source risks in the codebase and helps manage open-source license compliance. Commercial offering with free community edition.
• GitHub Advanced Security (GitHub native SCA): GitHub's built-in SCA capability, Dependabot, scans your dependencies for known vulnerabilities and automatically creates pull requests to update them.

Secret Scanning

Secret scanning tools detect secrets like passwords, tokens, and keys inadvertently committed to the codebase.

• GitHub Advanced Security: Provides secret scanning capabilities directly within GitHub. It can detect exposed credentials and other sensitive information in your repositories. Open-source and SaaS versions.
• GitGuardian: Specializes in detecting hardcoded secrets and credentials in source code. It integrates well with GitHub and other version control systems. SaaS version with free plan.
• Awake Security (now part of Arista Networks): Offers solutions that include detecting sensitive information in the codebase. SaaS version with free plan.

Integration with GitHub

If you're using GitHub, you might want to consider GitHub Advanced Security, which offers several of these features, including secret scanning and code scanning (which covers aspects of SAST). This can be a more integrated and streamlined approach, especially if your workflow is heavily centered around GitHub.

Additional Considerations

When choosing tools for static, dynamic, software composition, and secret scanning, consider the following factors:

• CI/CD Integration: Ensure that the tools you choose can integrate well with your continuous integration/continuous deployment (CI/CD) pipeline.
• Customization and Scalability: Consider tools that offer customization to fit your specific security policies and can scale with your project's growth.
• Compliance and Reporting: Tools that provide comprehensive reporting capabilities will help in meeting compliance requirements and in making informed security decisions.