Code Scanning Tools Do Not Make Software Secure

Michael Howard has an excellent post on how code Scanning tools do not make software secure. I think he had an interesting formula that sums it up:

"Not-so-knowledgeable-developer" + great tools == marginally more secure code

Running static analysis tools won't alone make your code secure. But its a great asset in your arsenal of tools to use alongside of secure programming principles and practices.

I think he hit it out of the ball park with this comment:

Creating secure software requires having an executive mandated, end-to-end process requiring on-going education, secure design based on threats, secure coding policy and testing policy, penetration and fuzz testing focused on new and old code, a credible response process and finally a feedback loop to learn from mistakes.

Yep. That's exactly it. Security is a process that has to have buy in from the top down, all the way from the CEO to the junior programmer. It has to be part of your software development lifecycle and has to accepted by all.

But great tools don't hurt!