2 Days Left! iPad Pro w/ Smart Keyboard or ASUS Chromebook w/ Online Training!

Webcasts

To attend this webcast, login to your SANS Account or create your Account.

Continuous Integration: Static Analysis with Visual Studio & Roslyn

  • Friday, February 24th, 2017 at 3:00 PM EST (20:00:00 UTC)
  • Eric Johnson
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!

Overview

For over 10 years, Visual Studio has provided basic source code analysis through FxCop and StyleCop. While these code analyzers focus mainly on design conformance, code consistency, and best practices, there is very little support for enforcing secure coding techniques. To address this gap, Microsoft started a project back in 2011 called CAT.NET to help identify secure coding bugs such as XSS, SQL Injection, and XPath Injection. Unfortunately, CAT.NET failed and never made it past the first version. Aside from purchasing expensive commercial static analysis tools, .NET development teams have been left without an easy way to integrate secure code scanning rules into Visual Studio. At least until now...

With the release of Visual Studio 2015, the open-source .NET Compiler Platform (aka "Roslyn") exposes a set of code analysis APIs capable of querying source code, identifying security issues, and reporting vulnerabilities. In this talk, we will explore the code analysis APIs and introduce you to Puma Scan: an open-source static analysis rules engine. Live demonstrations will show Puma Scan identifying vulnerabilities inside Visual Studio as code is written!

To learn more about .NET security from Eric Johnson, register for DEV544: Secure Coding in .NET at SANS 2017 in Orlando from April 9th - April 12th. Can't travel? DEV544 is also available online from the SANS OnDemand team.

Speaker Bio

Eric Johnson

Eric Johnson, the Application Security Curriculum product manager at SANS, is the lead author and instructor for DEV544 Secure Coding in .NET, as well as an instructor for DEV541 Secure Coding in Java/JEE. A senior security consultant at Cypress Data Defense, Eric's experience includes web and mobile application penetration testing, secure code review, risk assessment, static source code analysis, security research and developing security tools. He currently holds the CISSP, GWAPT, GSSP-.NET and GSSP-Java certifications.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.