Code Scanning

What is Code Scanning?

Code scanning is a technique used to proactively identify privacy risks, security vulnerabilities, or errors present within a software application's code.

Code scanning tools are typically run during the software development process to help ensure there are no privacy, security, or functionality issues with the code before it is pushed live. Engineering and DevOps teams can set scans to run each time new code is submitted for review or schedule periodic scans of all code to prevent issues before they occur.

Any issues identified are typically categorized and sent to the appropriate team for immediate resolution.

Code scanning has traditionally been used primarily to identify and resolve security vulnerabilities, but now there's a growing number of code scanning tools designed for identifying and resolving data privacy risks.

Since enforcement began for the EU's General Data Protection Regulation (GDPR) in 2018, data privacy regulation and enforcement has steadily increased globally, creating the need for proactive and automated privacy risk detection.

By scanning the code that runs websites, user-facing applications, and backend systems, privacy risks regarding data collection, usage, sharing, and storing can be automatically identified, eliminating the need for most manual assessments.  

Code Scanning Approaches

Static Analysis Security Testing (SAST) scans static source code to detect application vulnerabilities such as unauthorized access risks, cyberattack risks, unsecured API pass keys, and outdated software packages. Scanning static code means scans are done on code as it is written, i.e., without running the code or application. This method enables code to be reviewed piece by piece early in the development process before applications are completed or launched.

Privacy Code Scanning solutions scan static source code to automate full lifecycle data maps and enable programmatic privacy governance. Privacy code scanning can identify privacy risks at scale and in real-time because the logic for how personal data is collected, used, shared, and stored is written in the code running websites, user-facing applications, and backend systems. 

Dynamic Application Security Testing (DAST) identifies security vulnerabilities by testing code that is being run, i.e., during runtime, by simulating cyberattacks. DAST simulates cyberattacks that could be deployed on a live application in the web, on mobile, in the backend, etc. By subjecting the application to a library of known attacks such as cross-site scripting (XSS), SQL injections, and denial of service (DoS) and monitoring the response, DAST can identify security vulnerabilities that may not be detected by SAST. 

Interactive Analysis Security Testing (IAST) identifies security vulnerabilities by testing code during runtime, trying various inputs, and monitoring the outputs. This approach detects anomalous behavior that indicates exploitation of known or novel vulnerabilities within the application.

Source Composition Analysis (SCA) identifies an application’s dependencies on external code libraries / applications and checks them for known vulnerabilities that could impact the application’s security. As the use of open-source code libraries and applications grows, it is important to carefully examine each open-source component from a security perspective.