Learn real-world skills from real-world cyber security practitioners. View upcoming Live Online Events.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

Continuous Integration: Static Analysis with Visual Studio & Roslyn

  • Friday, February 24, 2017 at 3:00 PM EST (2017-02-24 20:00:00 UTC)
  • Eric Johnson

You can now attend the webcast using your mobile device!



For over 10 years, Visual Studio has provided basic source code analysis through FxCop and StyleCop. While these code analyzers focus mainly on design conformance, code consistency, and best practices, there is very little support for enforcing secure coding techniques. To address this gap, Microsoft started a project back in 2011 called CAT.NET to help identify secure coding bugs such as XSS, SQL Injection, and XPath Injection. Unfortunately, CAT.NET failed and never made it past the first version. Aside from purchasing expensive commercial static analysis tools, .NET development teams have been left without an easy way to integrate secure code scanning rules into Visual Studio. At least until now...

With the release of Visual Studio 2015, the open-source .NET Compiler Platform (aka "Roslyn") exposes a set of code analysis APIs capable of querying source code, identifying security issues, and reporting vulnerabilities. In this talk, we will explore the code analysis APIs and introduce you to Puma Scan: an open-source static analysis rules engine. Live demonstrations will show Puma Scan identifying vulnerabilities inside Visual Studio as code is written!

To learn more about .NET security from Eric Johnson, register for DEV544: Secure Coding in .NET at SANS 2017 in Orlando from April 9th - April 12th. Can't travel? DEV544 is also available online from the SANS OnDemand team.

Speaker Bio

Eric Johnson

Eric Johnson, Principal Security Engineer at Puma Security and Principal SANS Instructor, focuses on cloud security, DevSecOps automation, and building static analysis tools. His experience includes application security automation, cloud security reviews, static source code analysis, web and mobile application penetration testing, secure development lifecycle consulting, and secure code review assessments.

Need Help? Visit our FAQ page or email webcast-support@sans.org.

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.