[Autogenerated] Hi,
my name is George smith and I'm about to introduce you to
the cold analysis powers of sonar cube.
So what is sonar cube according to its creators.
Sonar source of Switzerland Sonar cube was initially
designed to give developers the ability to continuously
inspect the quality of cold they produce.
Currently covering 27 languages.
The tool can also be integrated with your continuous integration,
continuous delivery pipeline and help developers find understand and fix issues,
thereby enabling them to deliver high quality,
better, safer software.
The company model reads continuous inspection must become
mainstream as continuous integration and it rings true.
Soma cube is used by more than 100,000 organizations today
and you might ask so what is so special about this tool that
so many companies are using it?
A totally valid question where Sana cube really shines is the ability to find
problems before they become real problems whether it is bugs,
cold smells or other quality deficiencies of software that
make it suboptimal and can cost you money.
Or as we'll see in this course real or potential vulnerabilities called
hot spots that may cause a security event in the future.
If not fixed.
Let's dig a little deeper into these last two items related to IDE
security here is how sona cube works its magic.
In the first step, the programming language sensor part of the C.
X.
plugin reads the source code,
split it into tokens and generates an abstract syntax tree or a S.
T.
With the help of a grammar specific to the language
of the source code being scanned?
The S.
D.
Is the basis for software metrics and issues to be generated at a later stage.
In the second step,
the sonar scanner transfers the source code to the sonar cube database This
is followed by the third step where the sonar Q observer analyzes the
source code and generates artifacts like issues,
metrics, history, quality profiles and quality gates,
which scanner is used depends on the build tool and
the language under inspection,
I know that some languages include their own static cold analysis,
which comes out of the box and would say static simply because
the code is not running during the scan.
The final step is to present the artifacts in nicely organized
reports via the Sona Q b y for security analysts,
developers and other stakeholders to review and take
corrective action if necessary and just a quick peek under
the hood for the Sandra cube components,
you can take a look here in the documentation on a high level.
The sonar scanner is the component used to run the
analysis and to integrate when your continuous integration
and continuous delivery pipeline.
It contains the scanner itself along with the language analyzer.
This component consumes the source code files.
The Sandra cube server comprises the Web server,
the compute engine and the database.
The web server handles the sonar que web UI The search server is
Elasticsearch based and is used to run queries.
Finally, the compute engine,
does cold analysis and saves the resulting reports in the database from
a security perspective sona cube empowers developers to prevent
vulnerabilities from ever entering the code base.
It also helps tremendously that the vulnerabilities are standardized
by the open web application security project or all ask for short And
here are the 10 most critical security risk categories of which will
focus on a one injection, A two broken authentication,
A six security misconfigurations in and a seven cross site scripting.
A wasp in turn is well aligned with minor attack tactics,
techniques and procedures or T T P S.
The os risk categories were listed above online to T
1190 exploit public facing application.
T 1189 Drive by compromise and T 1078 valid accounts
since owner cube is open source.
We can always navigate to its good location based on the README description,
we can categorize sonar cube under detect in nist cybersecurity framework.
What deserves special attention here is the distinction between other
measures under detect that take place after a security event with sauna cube
will detect real and potential vulnerabilities in source code that if left
unchecked may result in security events in the future and this is the purpose
of static application security analysis or so fast that is continuously
conducted with Sana cube.
That way security related issues are no longer considered an
afterthought as developers receive real time feedback as they code this
fills the gaps in the cybersecurity framework that assumes security
events can be remedied only after the fact Sona cube allows us to
prevent such events from ever occurring.
Of course the tool also touches on some of the outcomes of
detect namely implementing security, continuous monitoring capabilities.
And while we're on the topic of sass and nist cybersecurity framework,
let's extend the conversation to minor attack and its tactics,
techniques and procedures.
Also known as T T.
P.
S.
From major attacks perspective we first look at the security data
analysis type in this case application analysis.
Then we look at the data type since we're analyzing an application,
this is simply its source code which then we link to the top level
tactics we will be dealing with during this course.
T 11 90 exploit public facing application.
T 1189 Docker by compromise and T 1078 valid accounts by
detecting these tactics with Sona cube will empower developers to
neutralize threats before they even occur.
And this is the real connection between matter attack
and sass tools like sonar cube.
So generally what are the advantages we get from SAS tools?
Well for starters shifting work to a more abundant resource,
security resources in an organization are always cars waiting for
security related code reviews can be a real challenge and the real
bottleneck to the software development lifecycle.
The second advantage is in terms of coverage.
Security professionals can cover only a small portion of the code
base which can be fast in enterprise applications.
By contrast, Sas tools like Sonar Cube can scan 100% of the code within minutes.
The third advantage is speed as manual.
Code reviews are inaccurate and take time to complete,
usually with several back and forth between the developer and the reviewers.
SaS tools report the problem immediately in a codified manner that very often
includes hints or easy fixes for the detected vulnerability.
Ultimately,
all of these advantages of SASS tools lead to dramatic
increases in software quality and that is why we need sona
cube with all this jazz out of the way,
we'll get started with Sona cube in the next clip.