Question: Lab-7: Security Testing With Static Vulnerability Scanners
March 1, 2023
Lab-7: Security Testing with Static Vulnerability Scanners
Readings:
- PyT form Facebook
- Bandit
- OWASP list of static security analyzers
- NIST list
One of the primary techniques for security testing is static analysis. Many open-source security scanner tools are available for the various programming languages. Such tools scan source code and look for a variety of security vulnerabilities including SQL injections, command injections, weak encryption, unreachable code, and many more. It is becoming a standard practice to include one or more static vulnerability scanners in the Continuous Integration (CI) pipeline.
Your task in this lab is to research and identify at least three tools for the Python language, run the tools against a list of open-source Python projects, and summarize your findings. A list of open-source Python projects will be provided by your Instructor.
Deliverables:
- Summary report of your findings. For each identified vulnerability, describe the security vulnerability and potential impact. Limit summary to 3 pages (1.5 spaced, 12 font size).
- Screenshots showing sample tool runs.
