CodeSonar 5.2 with Static Application Security Testing (SAST) Available

(Ithaca/New York/USA, Offenburg/Germany, 19 December 2019)

Version 5.2 of GrammaTech CodeSonar is now available for download. The new version of the Static Analysis Tools expands software teams' abilities to perform best-in-class Static Application Security Testing (SAST) across embedded and enterprise customers.
CodeSonar now supports AUTOSAR C++14, the latest C++ coding guidelines from AUTOSAR. With MISRA compliance included in previous releases, the addition of AUTOSAR support now sets CodeSonar at the forefront of the MISRA/AUTOSAR merging of standards.
The release of CodeSonar 5.2 also includes improved compiler support and open standards.
CodeSonar 5.2 continues its tight integration with JuliaSoft by supporting the latest release of the Julia engine, which provides high recall, high precision detection of security vulnerabilities in Java and C#.
Additionally, GrammaTech is expanding support for CodeSonar for Binaries.
The update is available as a free upgrade to eligible customers under active support and maintenance contracts. A 30-day trial of CodeSonar 5.2 is also available.

Free Webinar: What is New in CodeSonar 5.2?

Tuesday, December 17, 11am EST (17:00 Uhr CET, Berlin, Wien, Zürich) and 8pm EST (02:00 Uhr CET, Berlin, Wien, Zürich)

CodeSonar has been the preferred static analysis solution for software development teams building safety and security critical software built in C and C++. In recent releases CodeSonar has been expanding its language coverage through the use of open standards and it has added support for Java, C#, Objective C and C++, Python as well as JavaScript to its arsenal.
This expansion expands the domain in which CodeSonar can help software teams perform Static Application Security Testing (SAST). Software teams from embedded to enterprise domains can use CodeSonar to improve the quality and security of their software.
In this webinar, we will present the new features of CodeSonar 5.2, then use a variety of different projects to demonstrate CodeSonar’s deep static analysis capability on the crazyflie quadcopter by BitCraze, on GnuChess, a desktop application in C/C++, an IoT Edge application as well as some additional code in Python and JavaScript.
We will use Docker to run CodeSonar on these applications and view the warnings in both CodeSonar’s web GUI and visualization tool as well as in Microsoft Visual Code.

GrammaTech honours Verifysoft for the "Top Overall Deal" in Fiscal Year 2019

(Ithaca/New York/USA, 10 October 2019)

GrammaTech honoured Verifysoft for the top overall deal of the static code analysis tool CodeSonar in fiscal year 2019. It could be realised at a big german car manufacturer. Royd Lüdtke (Director Static Code Analysis) and Anna Kallenberg (Sales & Marketing D-A-CH) accepted the award in september in Ithaca, New York.
Verifysoft sets another milestone in the history of the longstanding cooperation with GrammaTech, which is on persistent growth since the beginning of their cooperation in 2013. GrammaTech´s static code analysis tool CodeSonar is successfully used by many customers in german speaking countries, among other things at leading car manufacturers, but also in a lot of other sectors like medical care, aerospace and defending or the agricultural engineering technology to improve their quality management.

GrammaTechs webinars in autumn

(Ithaca/New York/USA, Offenburg/Germany, 15 August 2019)

Why Realizing Safe, Secure Software Requires Building on Strong Foundations
Wednesday, September 25, 10:00 am EST, 04:00 pm CEST
In this webinar, GrammaTech will share how combining model driven analytical software development with static analysis provides the means to handle the increase in complexity and rapidly build robust, reliable and resilient cyber-physical systems based on strong foundations. Register here

Applying Aviation Cyber-Security via DO-326A / ED-202A
Wednesday, October 3, 12:00 pm EST, 06:00 pm CEST
This 1-Hour Technical Training webinar provides the basic info necessary to start planning your Aviation Cyber-Security needs to meed the year-end 2019 mandates. The new DO-326A (ED-202A), DO-355, DO-356 et al ecosystem is non-trivial but affects virtually everyone involved with aviation development and deployment. This AFuzion / Grammatech webinar prepares YOU to begin preparing TODAY for TOMORROW's threats, and mandates. Register here

Free Webinar: Preparing for ISO 26262 Version 2

(Ithaca/New York/USA, Offenburg/Germany, 13 August 2019)

ISO 26262 has become the de facto development standard for safety-critical automotive electronics. With version 2 of the standard set for publication, vendors across the automotive supply chain must be prepared to address new nomenclature and areas of the standard that could potentially impact engineering efforts. Tune in to this Automotive webcast with industry experts and learn more.
Date: Tuesday, 13th August 2019, 06:00 pm CEST, 11:00 am EST
Register here

Webinar with ARM and Wind River "Automotive Safety from the Ground Up: Hardware, OS and Static Analysis"

(Offenburg, 18 February 2019)

There are various software systems in a car, each with different security and safety requirements. In the webinar ARM, Wind River and GrammaTech highlight the capabilities on offer that help to build complex safety critical software systems.
ARM provides an overview on how their IP portfolio and the Arm Safety Ready Program enable customers to achieve functional safety. Wind River covers their operating system layer and how VxWorks works. This scalable, safety certified real-time operating system can provide OS features and flexibilities such as virtualization, in safety certifiable configurations.
Finally GrammaTech outlines how CodeSonar’s static analysis for source and binary helps write secure software. Furthermore, the section provides an overview on how the Tool Safety Manual, generated by CodeSonar’s Qualification Kit, guides users of static analysis in their safety argumentation.
Read the full article here.

Real World Benchmark for Static Code Analysis Tools

(Ithaca/New York, Offenburg, 4 February 2019)

Software development and quality managers that are looking to measure the benefit of static analysis can now use BugInjector, a tool that can inject Common Weakness Enumeration (CWE) based bug patterns into existing code bases, thus delivering real-world benchmarks. This independent real-world benchmarks have been created by GrammaTech under contract for the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) and are now available in the Software Assurance Marketplace (SWAMP) at no cost.
"There is an urgent need for benchmarks, such as those from GrammaTech, to allow software developers to evaluate static analysis tools in a comprehensive and real-world setting," says Barton Miller, Professor of Computer Sciences at the University of Wisconsin – Madison and Chief Scientist of SWAMP. "Also, developers of static analysis tools now have the ability to enhance their tools or benchmark new static analysis technologies with realistic test cases. Integrating these benchmarks into the SWAMP platform increases their effectiveness and availability."
Read the post here.

New GrammaTech Blog Posts

(Ithaca/New York, Offenburg/Germany, 24 January 2019)

The Role of Static Application Security Tools (SAST) in DevSecOps is an article which explains the role of static application security tools (SAST) such as GrammaTech CodeSonar and how they can be used in Dev(Sec)Ops and continuous development pipelines to improve quality and security.
Read the post here.
An other GrammaTech post with the title How Does the OWASP Top 10 Apply to C/C++ Development? shows a top ten list of the most critical web application security risks and how static code analysis helps to avoid this risks.
Read the post here.

DARPA Awards GrammaTech $8.4M USD for Autonomous Cyber Hardening Technology

(Ithaca/New York, January 2019)

GrammaTech announced that it has been awarded a $8.4 million USD, 4-year contract from Defense Advanced Research Projects Agency (DARPA), an agency of the U.S. Department of Defense, to develop technology that generates and deploys secure configurations to commercial off-the-shelf (COTS) equipment rapidly and largely autonomously.
Read the full article here.