The Parasoft CERT C Compliance extension is a set of assets for your DTP infrastructure that enable you to demonstrate compliance with CERT C Coding Standard guidelines. The extension is shipped as part of the Security Compliance Pack. Contact your Parasoft representative to download and license the Security Compliance Pack.
In this section:
The CERT C Coding Standard was developed by the CERT Coordination Center to improve the safety, reliability, and security of software systems. CERT coding standards consist of "rules" and "recommendations" and are organized into a set of categories. Rules provide code requirements for adhering to the standard, whereas recommendations are intended to provide guidance that improves the safety, reliability, and security of software systems.
Rules and recommendations are collectively referred to as "guidelines." Guidelines in the CERT C Secure Coding Standard are cross-referenced with Common Weakness Enumeration (CWE) entries. A programming pattern that fails to meet CWE's guidelines are called "weaknesses."
In terms of risk analysis, CERT uses three metrics to help quantify weaknesses:
The metrics are used to prioritize violations into three levels: L1 (highest priority), L2, and L3. The CERT C Compliance extension configures your DTP implementation to show static analysis violations according to their CERT C priority, guideline, type, and guideline category.
See https://wiki.sei.cmu.edu/confluence/display/c/Introduction to learn more about the standard.
C/C++test (Standard or Professional) with the Flow Analysis license feature enabled. See Security Compliance Pack for additional information.
Analyze code with C/C++test using the SEI CERT C Standard test configuration and report violations to DTP. You can configure C/C++test to use the local test configuration or the test configuration shipped with the Security Compliance Pack.
If you are using the 2022.1.1 release of the Security Compliance Pack and intend to use the shipped CERT test configurations for analysis, you will need to specify them using the 2022.1.1 version in the test configuration name. |
This section describes the assets shipped with the CERT C Compliance artifact.
The following configuration files provide CERT C-oriented compliance categories in DTP interfaces:
You can configure C/C++test to run the test configurations shipped with the tool or with the Security Compliance Pack. Refer to the C/C++test documentation for details. The following test configurations are included with the pack:
After installing the Security Compliance Pack and deploying the CERT compliance artifacts, you will be able to quickly add widgets configured to show CERT-related data by using the following dashboard templates:
See Custom Dashboard Templates for additional information about dashboard templates.
This is the DTP Workflow you must install and deploy in Extension Designer. It extends DTP’s data processing functionality to produce CERT-specific dashboard widgets and reports. It helps you track compliance status and document guideline enforcement, deviations, and rule re-categorization.
You can apply profiles to DTP Enterprise Pack extensions that perform custom calculations and drive reporting mechanisms in DTP.
See Working with Model Profiles for information about understanding profiles in DTP Enterprise Pack.
This profile extends the Key Performance Indicator artifact so that metrics widgets can show metrics information related to CERT C guidelines. The profile renders the data calculated by the cert-c-likelihood.json and cert-c-remediation-cost.json profiles.
In order to leverage the metrics calculations enabled by the KPI assets, install and deploy the Key Performance Indicator artifact. This artifact ships with the Security Compliance Pack, but you can contact your Parasoft representative to download a standalone instance of the artifact. |
For your convenience, a PDF that shows the association between Parasoft rules and CERT guidelines is located in the <PACK>/rules/cpptest directory.
This file describes the contents of the extension.
Parasoft static and flow analysis rules normally report violations according to a category (e.g., Possible Bug, Interoperability, etc.) and severity (i.e., 1-5). In order to view code analysis violations as CERT C guideline violations, DTP requires a rule map file that realigns Parasoft rules to report violations according to CERT C guidelines. In addition, the code analysis tool (C/C++test) needs a test configuration file that ensures that only the rules related to the remapped CERT C rules are executed. These files are shipped with C/C++test. |
The CERT C Compliance artifacts are installed as part of the Security Compliance Pack (see Installation for instructions). After installing the artifact, you must deploy the assets to your DTP environment.
If you are already using the CERT C++ Compliance artifact, you do not need to perform this step. Both artifacts use the same DTP Workflow. |
You can now add the CERT C Compliance dashboard and widgets.
The CERT C dashboard template will be available after installing the Security Compliance Pack. If you do not see dashboard template, restart DTP (see Stopping DTP Services and Starting DTP Applications).
If you have already executed C/C++test on your project using the SEI CERT C test configuration, most widgets will render data as soon as the dashboard is added. You can immediately begin working with the data to help you track your compliance goals (see Viewing CERT C Compliance Widgets). Additional steps, however, are necessary to use the Remediation Cost and Likelihood Score widgets, which rely on calculations executed by the KPI extension. See Enabling the CERT KPI Widgets for instructions.
You can manually add the CERT C widgets to an existing dashboard. See Adding Widgets for generation instructions on how to add widgets to a dashboard. After deploying the artifact, widgets will appear in the SEI CERT category.
The following configurations are available:
| Title | You can rename the widget in the Title field. This setting is available for all widgets. |
|---|---|
| Filter | Choose a specific filter or Dashboard Settings from the drop-down menu. See Creating and Managing Filters for additional information. This setting is available for all widgets. |
| Target Build | Choose a specific build from the drop-down menu. The build selected for the entire dashboard is selected by default. See Using Build Administration for additional information about understanding builds. This setting is available for all widgets. |
| Type | This rule specifies which type of guideline you want to view in the widget. Choose either Rule, Recommendation, or All from the drop-down menu. See Background for additional information about guideline types. This setting is available for the following widgets:
|
| Level | This rule specifies which priority level you want to view in the widget. Choose either L1, L2, or L3 from the drop-down menu. See Background for additional information about guideline priorities. This setting is available for the following widgets:
|
| Compliance Profile | Specify the compliance profile you want to use to view the data. In most cases, this should be the default profile shipped with the extension (see About the CERT Compliance Profile). This setting is available for all widgets. |
The Remediation Cost and Likelihood Score widgets are instances of the native Metrics - Summary DTP widget configured to present CERT-specific metrics data. When invoked, the KPI extension performs custom calculations according to the SEI CERT C Remediation Cost and SEI CERT C Likelihood KPI profiles and reports the processed data in the widgets.
The build must have static analysis and metrics analysis data for the KPI extension to perform the calculation. Be sure that C/C++test has been executed with the Metrics and SEI CERT C Guidelines test configurations under the same build ID. The metrics analysis must also include data for the Logical Lines of Code metric (metricId METRIC.NOLLOCIF). The guidelines test configuration will run analysis that provides violations for both rules and recommendations. You can also run the SEI CERT C Rules test configuration if do not need to gather data for recommendations. Refer to the C/C++test documentation for details about setting the build ID and executing the Metrics test configuration.
| filterId | The filter ID for the project that the calculations will be performed on. You can quickly get the filter ID from URL of your dashboard.
You can also get the filter ID from the the Filters settings in DTP administration (see Creating and Managing Filters). |
|---|---|
| profile | Profile name with the rules and weights to use for the calculations, i.e., SEI CERT C Remediation Cost or SEI CERT C Likelihood. |
| buildId | The build ID for which the calculations will be performed on. If no build id is provided, this parameter defaults to the latest build. You can get the build ID from the dashboard URL. The build ID is also shown in several widgets that appear in the CERT C Dashboard template, e.g., |
http://framemaker:8314/categories/5ae39f928550880f5026fc80?filterId=3&profile=SEI%20CERT%20C%20Likelihood |
{
"success": {
"title": "KPI",
"message": "Calculation has started for filter 'docs' using profile 'SEI CERT C Likelihood'. Check debug output for any errors during calculation."
}
} |
Metrics-related calculations are long-running processes and may take several minutes to execute depending on how much data you have to process. After the calculation completes, add the widgets to your dashboard to view the data. The KPI extension only needs to be deployed once, but you must invoke the API separately for each profile, i.e., SEI CERT C Likelihood and SEI CERT C Remediation Cost.
For additional views of the metrics, you can manually add instances of the native Metrics - Summary DTP widget to your dashboard and configure them to use the SEI CERT C Likelihood and SEI CERT C Remediation Cost metrics, as well as set the aggregation value:
You can click on a widget to open the Single Metric Overview Report.
The following widgets are shipped with the CERT C Compliance DTP Workflow to help you achieve CERT C compliance goals.
This widget provides an overview of the project's CERT compliance status.
By default, the widget shows Rules and Recommendations, as well as all priority levels. You can add multiple instances of the widget and configure different combinations to create robust views of the compliance status. Click on the widget to open the CERT C Compliance Report.
This widget provides an overview of the compliance status for each priority level in a tooltip for the target build. The tooltip also includes applicable deviations. Click on the widget to open the CERT C Compliance Report.
The widget shows the overall compliance status, as well as the compliance status for each CERT C level. You can add multiple instances of the widget configured to use a different profile, e.g., a profile with disabled guidelines, to view your current compliance status. Click on the widget to open the CERT C Compliance Report.
The code can be compliant with deviations and violations that have been deemed acceptable. See Deviation Report for additional information about deviations.
The status will be set to Not Compliant if Parasoft code analysis rules documented in your profile were not included in the specified build or if unacceptable violations have been reported. Make sure all rules are enabled in C/C++test and re-run analysis.
This widget shows the completeness of CERT compliance as a percentage. Completeness is based on the number of guidelines being enforced in the profile. Click on the widget to open the CERT C Compliance Report.
This widget shows the compliance status for a specific Rule or Recommendation per priority level. You can add multiple instances of the widget configured to different type/priority level combinations to help you understand your compliance status from different perspectives.
The pie chart can represent up to four different guideline statuses for the selected category:
| Green | Guidelines your code is in compliance with for the selected type and level. |
| Yellow | Guidelines that your code is deviating from but are still considered compliant. A deviation is when the guideline is not being followed according to the Parasoft static analysis rule, but is considered acceptable because it does not affect the safety of the software. Deviations represent Parasoft static analysis rules that have been suppressed. |
| Orange | Guidelines that your code is considered compliant with, even though the static analysis rules that enforce them contain violations. Only Recommendations can have this status. |
| Red | Guidelines that your code is not compliant with. |
You can perform the following actions:
This widget provides a representation of the highest concentration of static analysis violations per type and priority level. Tiles are color-coded according the priority level:
The Parasoft rule(s) enforcing compliance with the guidelines are also presented. Tiles are proportional to the number of static analysis violations reported for each rule.
The widget uses the hierarchy established in the model profile to correlate Parasoft rules with CERT rules, recommendations, and priorities. You can mouse over a tile in the widget to view the number of violations associated with each rule-guidline-category.
Click on a rule to see the violation in the Violations Explorer.
This widget is an implementation of the standard Compliance By Category widget shipped with DTP. It shows the number and percentage of rules in compliance grouped by rule categories.
Click on an entry in the table to open the Violations by Compliance Category report.
This widget is an implementation of the standard Categories - Top 5 Table Compliance widget shipped with DTP. It shows the five CERT guideline categories with the most violations.
Click on a link in the Name column or the more... link to open the Violations by Compliance Category report.
This widget is an implementation of the standard Categories - Top 5 Table widget shipped with DTP. It shows the five CERT guidelines with the most violations.
Click on a link in the Name column or the more... link to open the Violations by Compliance Category report.
This widget is an implementation of the standard Rules in Compliance - Summary widget shipped withe DTP. This widgets shows the following information:
Click on the widget to open the Violations by Compliance Category report.
The CERT Compliance Report provides an overview of your CERT compliance status and serves as the primary document for demonstrating compliance.
You can perform the following actions:
The CERT Compliance Report contains four supporting reports:
Conformance Testing PlanThe Conformance Testing Plan cross-references CERT guidelines with Parasoft static analysis rules using the data specified in the compliance profile. You can change the severity, likelihood, remediation cost, and other values to meet your project goals by configuring the profile.
Deviation ReportYour code can contain violations and still be CERT-compliant as long as the deviations from the standard are documented and that the safety of the software is unaffected. Deviations are code analysis rules that have been suppressed either directly in the code or in the DTP Violations Explorer. See the C/C++test documentation for details on suppressing violations in the code. See Suppressing Violations in the Violations Explorer documentation for information about suppressing violations in DTP. Click on the Deviation Report link in the CERT Compliance Report to open the Deviation Report.
The Deviations Report shows all guideline IDs and headers, but guidelines that have been suppressed will show additional information. You can perform the following actions:
Build Audit ReportThe Build Audit Report is native functionality in DTP. It shows an overview of code analysis violations, as well as test results and coverage information, associated with the build. This report also allows you to download an archive of the data, which is an artifact you can use to demonstrate compliance with CERT during a regulatory audit.
In order to download an archive, the build has to be locked. See Build Audit Report for additional details about this report. |
The Security Compliance Pack includes a profile associated with the core CERT C workflow and a set of profiles associated with calculating the SEI CERT C Remediation Cost and SEI CERT C Likelihood KPI metrics. See Working with Model Profiles for additional information about profiles.
The CERT C Compliance DTP Workflow ships with a default profile that includes information necessary for generating CERT compliance reports. The default profile shows the correlation between CERT guidelines and Parasoft code analysis rules and is suitable for most normal use cases.
We strongly advise against altering the default CERT C profile because doing so will affect any reports you may need to generate for auditing purposes. |
If necessary, you can make a copy of the default profile and adjust the correlation between Parasoft code analysis rules and CERT C guidelines to achieve your software quality and compliance goals.
The KPI artifact shipped with the Security Compliance Pack includes the SEI CERT C Likelihood and SEI CERT C Remediation Cost profiles. The profiles assign weights to the metrics analysis rules in order to calculate a KPI value for the build.
The default profile is suitable for most normal usage, but you can adjust the weights for each metrics rule if necessary.
