The Parasoft CERT for Java Compliance extension is a set of assets for your DTP infrastructure that enable you to demonstrate compliance with CERT Oracle Coding Standard for Java guidelines. The extension is shipped as part of the Security Compliance Pack. Contact your Parasoft representative to download and license the Security Compliance Pack.
In this section:
Table of Contents maxLevel 2
...
- Choose Extension Designer from the DTP settings (gear icon) menu.
- Click the Services tab and expand the DTP Workflows services category. You can deploy assets under any service category you wish, but we recommend using the DTP Workflows category to match how Parasoft categorizes the assets. You can also click Add Category to create your own service category (see Working with Services for additional information).
- You can deploy the artifact to an existing service or add a new service. The number of artifacts deployed to a service affects the overall performance. See Extension Designer Best Practices for additional information. Choose an existing service and continue to step 5 or click Add Service.
- Specify a name for the service and click Confirm.
- The tabbed interface helps you keep artifacts organized within the service. Organizing your artifacts across one or more tabs does not affect the performance of the system. Click on a tab (or click the + icon to add a new tab) and choose Import the vertical ellipses menu.
- Choose Local > Flows > Workflows > Security > CERT Compliance and click Import.
- Click anywhere in the open area to drop the artifact into the service.
- Click Deploy and return to your DTP dashboard.
- Refresh your browser.
...
- Click Add Dashboard in the DTP toolbar and specify a name when prompted.
- (Optional) You can configure the default view for the dashboard by specifying the following information:
- Choose the filter associated with your project in the filter drop-down menu. A filter represents a set of run configurations that enabled custom views of the data stored in DTP. See DTP Concepts for additional information.
- Specify a range of time from the Period menu.
- Specify a range of builds from the Baseline Build and Target Build menus.
- Enable Create dashboard from a template and choose the SEI CERT Oracle Coding Standard for Java Compliance template from the associated menu.
- Click Create to finish adding the dashboard.
...
| Anchor | ||||
|---|---|---|---|---|
|
You can manually add the After deploying the artifact, you can add CERT for Java widgets to an existing a dashboard. See See Adding Widgets for general instructions on how to add widgets to a dashboard. After deploying the artifact, widgets will appear in the SEI CERT category. 
more information about this process. CERT for Java widgets can be found in the SEI CERTcategory.
The following configurations are available:
...
The Parasoft rule(s) enforcing violations are also presented. Tiles are proportional to the number of static analysis violations reported for each rule.
The widget uses the hierarchy established in the model profile to correlate Parasoft rules with CERT rules, recommendations, and priorities. You can mouse over a tile in the widget to view the number of violations associated with each rule/guideline/category.
...
This widget is an implementation of the standard Categories - Top 5 Table widget shipped with DTP. It shows the five CERT guideline categories with the most violations.
...
This widget is an implementation of the standard Categories - Top 5 Table widget shipped with DTP. It shows the five CERT guidelines with the most violations.
...
The CERT Compliance Report provides an overview of your CERT compliance status and serves as the primary document for demonstrating compliance.
The report can show the following states:
...
| Table of Content Zone | ||||||
|---|---|---|---|---|---|---|
| ||||||
Conformance Testing PlanThe Conformance Testing Plan cross-references CERT guidelines with Parasoft static analysis rules using the data specified in the compliance profile. You can change the severity, likelihood, remediation cost, and other values to meet your project goals by configuring the profile. Click on a guideline to view the CERT documentation on the CERT website.
Deviation ReportYour code can contain violations and still be CERT-compliant as long as the deviations from the standard are documented and that the safety of the software is unaffected. Deviations are code analysis rules that have been suppressed either directly in the code or in the DTP Violations Explorer. See the Jtest documentation for details on suppressing violations in the code. See Suppressing Violations in the Violations Explorer documentation for information about suppressing violations in DTP. Click the Deviation Report link in the CERT Compliance Report to open the Deviation Report.
The Deviations Deviation Report shows all guideline IDs and headers , but guidelines that have been suppressed will show additional informationwith deviations. You can perform the following actions:
Build Audit ReportThe Build Audit Report is native functionality in DTP. It shows an overview of code analysis violations, as well as test results and coverage information, associated with the build. This report also allows you to download an archive of the data, which is an artifact you can use to demonstrate compliance with CERT during a regulatory audit.
In order to download an archive, the build has to be locked. See Build Audit Report for additional details about this report. |
...