WP3 Security SQA INDIGO - DataCloud John Kewley Ian Neilson STFC – UK john.kewley@stfc.ac.uk ian.neilson@stfc.ac.uk

WP3 Security SQA Background - D3.1 - Initial Plan for WP3 Quality Criteria Code Style Unit Testing Functional and Integration Testing Code Review Documentation Metrics, including ….. … “Number of software vulnerabilities” …. These are all good for Security Can this be improved? What can we do to help?

WP3 Security SQA 3 phase approach Code analysis (ongoing) SWAMP toolset Service [architecture] review (beginning) Select a few key services - IM, Orchestrator, Onedata, …? Asset evaluation -> protection of data and comms. Configuration -> documentation and risks Combine off-the-shelf scanners with manual review Traceability testing (later) Can a user (who, where, when) be traced from an action? Is the logging adequate?

What is SWAMP SoftWare Assurance MarketPlace Suite of static code analysis tools (one isn’t enough) A good variety of tools supported, incl. some commercial, assessing many aspects of code Range of languages supported incl. Python, Java, C/C++ Potential to link into Jenkins SWAMP: https://continuousassurance.org SWAMP portal: https://www.mir-swamp.org Static tools: https://samate.nist.gov/docs/NIST_Special_Publication_500-297.pdf

The SWAMP Process Rather than spending time installing, licensing and configuring software assessment tools on your own machines, you can use SWAMP. Upload your package First, upload your code. It remains private and secure. Run your assessment Next, create and run an assessment by choosing a package, tool, and platform. View your results Last, view your results using a native viewer or Code Dx™ for full featured analysis.