docs/2_Architecture_Guides/2.2_Security_Blueprint/9_Secure_development/1.2.9.0_Abstract.md

   1 ---
   2 title: Introduction
   3 ---
   4
   5 # Part 9 - Secure development
   6
   7 In order to save a lot of time in code auditing, developers must follow coding
   8 guidelines.
   9
  10 ## Secure build
  11
  12 ### Kernel build
  13
  14 Tools like:
  15
  16 - [Code optimisation](https://github.com/jduck/lk-reducer).
  17 - [Kernel Drivers test](https://github.com/ucsb-seclab/dr_checker) with
  18   [docs](https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-machiry.pdf).
  19
  20 <!-- section-todo -->
  21
  22 Domain                  | Improvement
  23 ----------------------- | ------------
  24 SecureDev-SecureBuild-1 | Add content.
  25
  26 <!-- end-section-todo -->
  27
  28 ## App/Widget signatures
  29
  30 <!-- section-todo -->
  31
  32 Domain                 | Improvement
  33 ---------------------- | ------------
  34 SecureDev-Signatures-1 | Add content.
  35
  36 <!-- end-section-todo -->
  37
  38 ## Code audit
  39
  40 These tools are used to check the correct implementation of functionalities and
  41 compliance with related good practices.
  42
  43 - [Continuous Code Quality](https://www.sonarqube.org/).
  44
  45 <!-- section-todo -->
  46
  47 Domain                | Improvement
  48 --------------------- | -----------------------------------------------------
  49 SecureDev-CodeAudit-1 | Add CVE analyser.
  50 SecureDev-CodeAudit-2 | [OSSTMM](http://www.isecom.org/mirror/OSSTMM.3.pdf).
  51
  52 <!-- end-section-todo -->
  53
  54 ### SATS
  55
  56 - [RATS](https://github.com/andrew-d/rough-auditing-tool-for-security) (Maybe to
  57   old).
  58 - [Flaw Finder](https://www.dwheeler.com/flawfinder/).
  59
  60 - [wiki
  61   list](https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis).
  62
  63 - [Mathematical
  64   approach](https://perso.univ-rennes1.fr/david.lubicz/planches/David_Pichardie.pdf).
  65
  66 It is necessary to verify that the application code does not use functions that
  67 are depreciated and recognized as unsecured or cause problems.
  68
  69 ### DATS
  70
  71 - [wiki
  72   list](https://en.wikipedia.org/wiki/Dynamic_program_analysis#Example_tools).