Once the teams have been using the code scanning tools for a while, the security team may help to optimize the tools, processes, or rules based on user feedback. Here are some key factors to be optimized for a large-scale code scanning adoption:
|
Key factors |
Suggestions |
|
Scanning rules customization |
The purpose of rules customization is to help the project team reduce false positives. The security team may help to disable some rules that don't apply to the projects or change rules that always result in false positives. |
|
Recommendation fixes |
Ideally, IDE plugins will present not only security warnings but also suggested fixes. However, if the tools you are using don't support the team, using the OWASP Security Knowledge Framework can be an alternative. |
|
Integration |
Integrate code scanning tools into Jenkins, and developers&apos... |