Versions Compared

Old Version 1

changes.mady.by.user Robert Andelin

Saved on

compared with

New Version 2

changes.mady.by.user Robert Andelin

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Published by Scroll Versions from space DTPDEVEL and version 2024.1

...

In terms of risk analysis, CERT uses three metrics to help quantify weaknesses:

  • the The severity of of the consequences associated with a failure to comply with the rule.
  • the The likelihood that that a coding flaw introduced by ignoring the rule will result in an exploitable vulnerability.
  • the The remediation cost associated associated with complying with the rule.

The metrics are used to prioritize violations into three levels: L1 (highest priority), L2, and L3. The CERT C Compliance extension configures your DTP implementation to show static analysis violations according to their CERT C priority, guideline, type, and guideline category.

...

  • cert-compliance.json: This model file describes how the CERT C and CERT C++ profiles render the data. 
  • cert-c.json: This is the default profile that renders data according to the certthe cert-compliance.json modeljson model. This profile should be enabled to generate compliance audit reports.
  • cert-c-likelihood.json: This profile provides metric information for key performance indicator (KPI) calculations. It renders data according to the KPI.json model.
  • cert-c-remediation-cost.json: This profile provides metric information for KPI calculations. It renders data according to the KPI.json model.

...

This profile extends the Key Performance Indicator artifact so that metrics widgets can show metrics information related to CERT C guidelines. The profile renders the data calculated by the cert-c-likelihood.json and cert-c-remediation-cost.json profiles.

Info
titleKey Performance Indicator Extension is Required

In order to leverage the metrics calculations enabled by the KPI assets, install and deploy the Key Performance Indicator artifact. This artifact ships with the Security Compliance Pack, but you can contact your Parasoft representative to download a standalone instance of the artifact.

...

For your convenience, a PDF that shows the association between Parasoft rules and CERT guidelines is located in the <PACK>/rules/cpptest directory.  

package.json

This file describes the contents of the extension.

Info
titleRule Map and Test Configuration

Parasoft static and flow analysis rules normally report violations according to a category (e.g.for example, Possible Bug,  InteroperabilityInteroperability, etc.) and severity (i.e., 1-5). In order to view code analysis violations as CERT C guideline violations, DTP requires a rule map file that realigns Parasoft rules to report violations according to CERT C guidelines. In addition, the code analysis tool (C/C++test) needs a test configuration file that ensures that only the rules the rules related to the remapped CERT C rules are executed. These files are shipped with C/C++test.

...

  1. Choose Extension Designer from the DTP settings (gear icon) menu.
  2. Click the Services tab and expand the DTP Workflows services category. You can deploy assets under any service category you wish, but we recommend using the DTP Workflows category to match how Parasoft categorizes the assets. You can also click Add Category to create your own service category (see Working with Services for additional information).
  3. You can deploy the artifact to an existing service or add a new service. The number of artifacts deployed to a service affects the overall performance. See Extension Designer Best Practices for additional information. Choose an existing service and continue to step 5 or click Add Service.
  4. Specify a name for the service and click Confirm.
  5. The tabbed interface helps you keep artifacts organized within the service. Organizing your artifacts across one or more tabs does not affect the performance of the system. Click on a tab (or click the + button icon to add a new tab) and choose Import from the ellipses menu.
  6. Choose Local> Flows> Workflows> Security> Local > Flows > Workflows > Security > CERT Compliance and click Import.
  7. Click anywhere in the open area to drop the artifact into the service. 
  8. Click Deploy and return to your DTP dashboard.
  9. Refresh your browser.

...

  1. Click Add Dashboard in the DTP toolbar and specify a name when prompted. 
  2. (Optional) You can configure the default view for the dashboard by specifying the following information:
    1. Choose the filter associated with your project in the filter drop-down menu. A filter represents a set of run configurations that enabled custom views of the data stored in DTP. See DTP Concepts for additional information.
    2. Specify a range of time from the Period drop-down menu. 
    3. Specify a range of builds from the Baseline Build and Target Build drop-down menus.  

  3. Enable the Create dashboard from a template option and choose the SEI CERT C Compliance dashboard from the associated menu.
  4. Click Create to finish adding the dashboard.

...

TitleYou can rename the widget in the Title field. This setting is available for all widgets.
FilterChoose a specific filter or Dashboard Settings from the drop-down menu. See Configuring Filters for additional information. This setting is available for all widgets.
Target BuildChoose a specific build from the drop-down menu. The build selected for the entire dashboard is selected by default. See See Using Build Administration for additional information about understanding builds. This setting is available for all widgets. 
Type

This rule specifies which type of guideline you want to view in the widget. Choose either Rule, Recommendation, or All from the drop-down menu. See Background for additional information about guideline types. This setting is available for the following widgets:

  • CERT Compliance - Guidelines by Status
  • CERT Levels - Target
  • CERT Violations by Category - TreeMap
Level

This rule specifies which priority level you want to view in the widget. Choose either L1, L2, or L3 from the drop-down menumenu. See Background for additional information about guideline priorities. This setting is available for the following widgets:

  • CERT Compliance - Guideline by Status
  • CERT Compliance - Percentage
  • CERT Violations by Category - TreeMap
Compliance ProfileSpecify the compliance profile you want to use to view the data. In most cases, this should be the default profile shipped with the extension (see About the CERT Compliance Profile). This setting is available for all widgets.

...

The build must have static analysis and metrics analysis data for the KPI extension to perform the calculation. Be sure that C/C++test has been executed with the Metrics and SEI CERT C Guidelines test configurations under the same build ID. The metrics analysis must also include data for the Logical Lines of Code metric (metricId METRIC.NOLLOCIF). The guidelines test configuration will run analysis that provides violations for both rules and recommendations. You can also run the SEI CERT C Rules test configuration if do not need to gather data for recommendations. Refer to the C/C++test documentation for details about setting the build ID and executing the Metrics test configuration.  

  1. Choose Extension Designer from the DTP settings (gear icon) menu and click the Services tab. 
  2. Choose a service category and a service for the extension. We recommend deploying the KPI extension to the DTP Workflows category.
  3. Open the vertical ellipses menu and choose Import> Local> Flows> Workflows> Security> Import > Local > Flows > Workflows > Security > Key Performance Indicator.
  4. Click anywhere in the space to drop the flow into the service tab and click Deploy.
  5. Click on the compliance category (i.e., DTP Workflows) and expand your service to expose the available endpoints.
  6. Expand the Key Performance Indicator section and copy the endpoint. 
  7. Send a REST request to the endpoint along with the required parameters. For example, you can execute the request in a browser, a cURL command, or add it to a script. The following table describes the required parameters:
filterId

The filter ID for the project that the calculations will be performed on. You can quickly get the filter ID from URL of your dashboard.

 

You can also get the filter ID from the the Filters settings in DTP administration (see Configuring Filters).

profileProfile name with the rules and weights to use for the calculations, i.e., such as SEI CERT C Remediation Cost or SEI CERT C Likelihood.
buildId

The build ID for which the calculations will be performed on. If no build id ID is provided, this parameter defaults to the latest build.

You can get the build ID from the dashboard URL. The build ID is also shown in several widgets that appear in the CERT C Dashboard template, e.g.,for example:
 

Code Block
languagepowershell
titleExample API Call URL
http://framemaker:8314/categories/5ae39f928550880f5026fc80?filterId=3&profile=SEI%20CERT%20C%20Likelihood

...

Metrics-related calculations are long-running processes and may take several minutes to execute depending on how much data you have to process. After the calculation completes, add the widgets to your dashboard to to your dashboard to view the data. The KPI extension only needs to be deployed once, but you must invoke the API separately for each profile, i.e., such as SEI CERT C Likelihood and SEI CERT C Remediation Cost.

...

For additional views of the metrics, you can manually add instances of the native Metrics - Summary DTP widget to your dashboard and configure them to use the SEI CERT C Likelihood and SEI CERT C Remediation Cost metrics, as well as set the aggregation value: .

You can click on a widget to open the Single Metric Overview Report.

...

The widget shows the overall compliance status, as well as the compliance status for each CERT C level. You can add multiple instances of the widget configured to use a different profile, e.g.for example, a profile with disabled guidelines, to view your current compliance status.  Click on the widget to open the CERT C Compliance Report. 

...

GreenGuidelines your code is in compliance with for the selected type and level.
Yellow

Guidelines that your code is deviating from but are still considered compliant.

A deviation is when the guideline is not being followed according to the Parasoft static analysis rule , but is considered acceptable because it does not affect the safety of the software. Deviations represent Parasoft static analysis rules that have been suppressed.

Orange

Guidelines that your code is considered compliant with, even though the static analysis rules that enforce them contain violations. Only Recommendations can have this status.

RedGuidelines that your code is not compliant with.

...

This widget provides a representation of the highest the highest concentration of static analysis violations per type and priority level. Tiles are color-coded according to the priority level:

  • red Red tiles represent L1 violations.
  • yellow Yellow tiles represent L2 violations violations. 
  • green Green tiles represent L3 violations.

The Parasoft rule(s) enforcing compliance with the guidelines are also presented. Tiles are proportional to the number of static analysis violations reported for each rule. 

...

The widget uses the hierarchy established in the model profile to to correlate Parasoft rules with CERT rules, recommendations, and priorities. You can mouse over a tile in the widget to view the number of violations associated with each rule-guidline-/guideline/category.

Click on a rule to see the violation in the Violations Explorer.

...

This widget is an implementation of the standard Categories - Top 5 Table Compliance widget shipped with DTP. It shows the five CERT guideline categories with the most violations.

Click on a link in the Name column or the more... link to open the Violations by Compliance Category report.

...

This widget is an implementation of the standard Categories - Top 5 Table widget shipped with DTP. It shows the five CERT guidelines with the most violations.

Click on a link in the Name column or the more... link to open the Violations by Compliance Category report.

...

This widget is an implementation of the standard Rules in Compliance - Summary widget shipped withe DTP. This widgets widget shows the following information:

  • how How many static analysis rules for the selected compliance standard were enabled during code analysis.
  • how How many violations were reported.
  • the The overall percentage of rules that did not report violations.
  • the The change in number of violations from the baseline build to the target build as a percentage (if applicable).

 Click on the widget to open the Violations by Compliance Category report. 

...

You can perform the following actions:

  • Use the drop-down menus to sort by the following criteria:
    • Guideline type: Rule, Recommendation, or All 
    • Priority level: L1, L2, L3, or All
    • Compliance status: All, No Rules Enabled, Compliant, Compliant With Deviations, Compliant With Violations, Not Compliant, Missing Rule(s) in Analysis
  • Click on a guideline link in the Guideline column to open the Conformance Enforcement Plan. The link goes directly to the specific guideline so that you can review the Parasoft code analysis rule or rules enforcing the guideline. 
  • Click on a link in the # of Violations column to view the violations in the the Violations Explorer.
  • Click on a link in the # of Deviations column to view the suppressed violations in the the Violations Explorer.
  • Open one of the CERT Compliance sub-reports.
  • Click Download PDF to download a printer-friendly PDF version of the report data. If you added a custom graphic to DTP as described in Adding a Custom Graphic to the Navigation Bar, the PDF will also be branded with the graphic. 

...

Table of Content Zone
maxLevel2
minLevel2
locationtop

Conformance Testing Plan

The Conformance Testing Plan cross-references CERT guidelines with Parasoft static analysis rules using the data specified in the compliance profile. You can change the severity, likelihood, remediation cost, and other values to meet your project goals by configuring the profile.

Deviation Report 

Your code can contain violations and still be CERT-compliant as long as the deviations from the standard are documented and that the safety of the software is unaffected. Deviations are code analysis rules that have been suppressed either directly in the code or in the DTP Violations Explorer. See the C/C++test documentation for details on suppressing violations in the code. See Suppressing Violations in the Violations Explorer documentation for information about suppressing violations in DTP.

Click on the Deviation Report link in the CERT Compliance Report to open the Deviation Report. 

The Deviations Report shows all guideline IDs and headers, but guidelines that have been suppressed will show additional information. You can perform the following actions:

  1. Filter the report by type (Rule, Recommendation, All).
  2. Filter the report by level (L1, L2, L3).
  3. Enable the Only Deviations option to only show deviations.
  4. Enable the Hide Modification History option to exclude the modification history for deviations   .

Build Audit Report

The Build Audit Report is native functionality in DTP. It shows an overview of code analysis violations, as well as test results and coverage information, associated with the build. This report also allows you to download an archive of the data, which is an artifact you can use to demonstrate compliance with CERT during a regulatory audit.

In order to download an archive, the build has to be locked. See Build Audit Report for additional details about this report.  

...

  1. Open Extension Designer and click the Model Profile tab.
  2. Expand the CERT Compliance model and choose the SEI CERT C 2018 profile. 
  3. Click Export Profile to download a copy. 
  4. Click Add Profile and enter a name.
  5. Click Confirm to create an empty profile. 
  6. Rename the copy of the default profile you exported and click Import Profile. 
  7. Browse for the copy and confirm to upload.
  8. Click Edit and make your adjustments. 
  9. Click Save.

CERT C KPI Profiles

The KPI artifact shipped with the Security Compliance Pack includes the SEI CERT C Likelihood and SEI CERT C Remediation Cost profiles. The profiles assign weights to the metrics analysis rules in order to calculate a KPI value for the build.

...

  1. Open Extension Designer and click the Model Profile tab.
  2. Expand the KPI model and choose either the SEI CERT C Likelihood or SEI CERT C Remediation profile.
  3. Click Export Profile to download a copy. 
  4. Click Add Profile and enter a name.
  5. Click Confirm to create an empty profile. 
  6. Rename the copy of the default profile you exported and click Import Profile. 
  7. Browse for the copy and confirm to upload.
  8. Click Edit and make your adjustments. 
  9. Click Save.