1. WP3 Security SQA INDIGO - DataCloud
John Kewley
Ian Neilson STFC – UK

2. WP3 Security SQA Background - D3.1 - Initial Plan for WP3
Quality Criteria
Code Style
Unit Testing
Functional and Integration Testing
Code Review
Documentation
Metrics, including …..
… “Number of software vulnerabilities” ….
These are all good for Security
Can this be improved?
What can we do to help?

3. WP3 Security SQA 3 phase approach Code analysis (ongoing)
SWAMP toolset
Service [architecture] review (beginning)
Select a few key services - IM, Orchestrator, Onedata, …?
Asset evaluation -> protection of data and comms.
Configuration -> documentation and risks
Combine off-the-shelf scanners with manual review
Traceability testing (later)
Can a user (who, where, when) be traced from an action?
Is the logging adequate?

4. What is SWAMP SoftWare Assurance MarketPlace
Suite of static code analysis tools (one isn’t enough)
A good variety of tools supported, incl. some commercial, assessing many aspects of code
Range of languages supported incl. Python, Java, C/C++
Potential to link into Jenkins
SWAMP:
SWAMP portal:
Static tools:

5. The SWAMP Process
Rather than spending time installing, licensing and configuring software assessment tools on your own machines, you can use SWAMP.
Upload your package First, upload your code. It remains private and secure.
Run your assessment Next, create and run an assessment by choosing a package, tool, and platform.
View your results Last, view your results using a native viewer or Code Dx™ for full featured analysis.