In this section:
The Parasoft CWE Compliance artifact is a set of assets for your DTP infrastructure that enable you to readily demonstrate compliance with CWE Top 25 and CWE List Version 2.11 development guidelines. The artifact is shipped as part of the Security Compliance Pack for DTP 5.4.0. Contact your Parasoft representative for download and licensing information.
The 2011 CWE/SANS Top 25 Most Dangerous Software Errors is a list of the most widespread and critical errors that can lead to serious vulnerabilities in software. They are often easy to identify and exploit by attackers, allowing them to completely take over the software, steal data, or prevent the software from working at all.
Visit http://cwe.mitre.org/top25/ to learn more about the CWE Top 25 standard.
The Common Weakness Enumeration (CWE) is a list of software weaknesses types. It is an ongoing community-driven effort to capture the specific effects, behaviors, exploit mechanisms, and implementation details affecting software development. The items on the list are created with input from many organizations and individuals. The position on the list is chosen based on real-world criteria, such as prevalence, ease-of-exploit, etc.
Visit https://cwe.mitre.org/data/ to learn more about the CWE List.
The CWE Compliance extension helps you create the documentation required for demonstrating compliance with CWE guidelines. The following artifacts are included in the package.
The pack ships with four sets of compliance categories that enable CWE-centric views of the static analysis data reported by the code analysis tools:
| File | Description |
|---|---|
| compliance_cweid_all.xml | MITRE CWE 2.11 This set of compliance categories re-maps the static analysis violations so that they are grouped and displayed as CWE List Version 2.11 errors in widgets and reports. |
| compliance_impact_all.xml | MITRE CWE 2.11 - Technical Impact This set of compliance categories re-maps the static analysis violations so that they are grouped and displayed in widgets and reports by their technical impact according to CWE List Version 2.11 guidelines. The "technical impact" is a weakness categorization in CWE. See https://cwe.mitre.org/cwraf/ti_scorecard.html for additional information. |
| compliance_cweid_top25.xml | 2011 CWE/SANS Top 25 This set of compliance categories re-maps the static analysis violations so that they are grouped and displayed as CWE/SANS Top 25 Most Dangerous Software Programming Errors in widgets and reports. |
| compliance_impact_top25.xml | 2011 CWE/SANS Top 25 - Technical Impact This set of compliance categories re-maps the static analysis violations so that they are grouped and displayed in widgets and reports by their technical impact according to CWE/SANS Top 25 Most Dangerous Software Programming Errors guidelines. The "technical impact" is a weakness categorization in CWE. See https://cwe.mitre.org/cwraf/ti_scorecard.html for additional information. |
See カスタム コンプライアンス カテゴリ for additional information about rule categories in DTP.
The template adds security compliance-related widgets to your DTP dashboard (see カスタム ダッシュボード テンプレート for additional information about dashboard templates).
The extension ships with the following DTP Workflows (also called 'slices').
This slice contains a set of widgets that you can configure to show CWE violations. See Security Compliance Widgets for OWASP.
In order to leverage the metrics calculations enabled by the KPI assets, the Security Compliance Pack ships with the Key Performance Indicator (KPI) artifact. This artifact is also available separately from the Parasoft Marketplace.
The Key Performance Indicator (KPI) Process Intelligence slice defines a KPI associated with static analysis rules so you can measure and quantify results. The KPI slice uses model profiles to perform custom calculations (see モデル プロファイルの使用). You can adjust the calculations by modifying the profile.
KPI ships with an example model profile called “Security Impact” that demonstrates how you can adjust the weight of static analysis rules to define your own KPIs, such as the impact of a rule on security.
Every rule can have a different weighting, and not every rule has to be in the profile, which enables you to run different KPIs for different purposes and different profiles for different subsets of rules.
Depending on the volume of data being analyzed, KPI calculation may require multiple runs to acquire the core data and may take significant time, therefore triggering KPI calculation should be done as part of your build process or by manually using a trigger node in the KPI slice. |
After configuring the profile, it must be passed when invoking the KPI slice to run the calculation. See Invoking the Calculation for instructions on invoking KPI with the Security Impact profile enabled.
After deploying the DTP Workflows and running the KPI slice, add the CWE Top 25 template to your dashboard (see ダッシュボードの追加).
The following widgets are added when you installed.
This widget shows the overall compliance status as a percentage. Each pie chart segment represents a compliance category that the code violates. The widget also shows the total number of compliance categories being applied and the number of categories with which the code is compliant. The dashboard adds an instance of the widget for each set of compliance categories. See Configuring CWE Widgets for details on configuring the widget.
You can perform the following actions:
You can use this widget with any compatible compliance category in your DTP system. See ウィジェットの追加 for instructions on how to manually add the widget to your dashboard.
This widget shows the violations grouped by compliance in a tree map. Each tile is assigned a color and represents a compliance category. The dashboard includes an instance of the widget configured to show the 2011 CWE/SANS Top 25 - Technical Impact compliance category. See Configuring CWE Widgets for details on configuring the widget.
You can perform the following actions:
You can use this widget with any compatible compliance category in your DTP system. See ウィジェットの追加 for instructions on how to manually add the widget to your dashboard.
The dashboard adds an implementation of the Metrics - Summary widget configured to show metric data based on the running KPI slice. See Metrics - Summary for details on how to use this widget.
The dashboard adds an implementation of the Rules in Compliance - Summary widget configured to show metric data based on the running KPI slice. See Rules in Compliance - Summary for details on how to use this widget.
This widget shows the distribution of Parasoft metadata (priority, action, and risk impact) associated with the violations reported in the filter. You can add an instance of the widget for each type of metadata. See Configuring CWE Widgets for details on configuring the widget.
You can perform the following actions:
For new projects or for projects in which the metadata has not been set, the chart will show undefined metadata for the violations reported.
You can manually set the metadata in the Violations Explorer (see Addressing Violations) or implement a flow as part of your build automation process to automatically set the metadata (see the 違反のメタデータの更新 tutorial for additional information).
You can use this widget with any compatible compliance category in your DTP system. See ウィジェットの追加 for instructions on how to manually add the widget to your dashboard.
Title | Enter a new title to replace the default title that appears on the dashboard. |
|---|---|
Filter | Choose Dashboard Settings to use the dashboard filter or choose a filter from the drop-down menu. |
Target Build | Choose a build from the drop-down menu. Only the data for this build will appear in the widget. |
Compliance | Choose one of the following compliance category groups (see CWE Compliance Rule Categories for details):
You can also choose any other compliance category available in DTP. |
Group by | Choose a type of metadata to group by in the widget (priority, action, and risk impact). This settings is only available for the Compliance Violations by Metadata widget. |
This report shows the violations grouped by priority, risk, or action depending on the configuration of the widget you clicked to open the report.
The report is filtered by the widget segment you clicked, but you can use the Group By drop-down menu to filter the report by different metadata values.
You can also click on a link in the Violation Count column to open the 違反エクスプローラー.