Synopsys announces overhaul of app security testing tool

Electronic design automation software provider Synopsys has announced the availability of new features of its Rapid Scan tool, which provides vulnerability detection for proprietary and open source code.

The new capabilities fall within the company's Coverity static application security testing (SAST) and Black Duck software composition analysis (SCA) solutions. Rapid Scan's new features complement conventional application security testing activities by enabling development teams to perform fast SAST, and SCA scans at every code check-in or early-stage build without slowing them down.

This allows developers to shift left, says Synopsys Software Integrity Group GM Jason Schmitt — and helps prevent security risks from progressing into the later stages of the software development lifecycle (SDLC).

"One of the hallmarks of modern software development is breaking down large processes into smaller, more manageable tasks that can performed rapidly and concurrently in a distributed fashion," says Schmitt.

"For organisations embracing DevSecOps, application security testing needs to follow suit. With Rapid Scan, Coverity and Black Duck users can run quick preventative scans to detect and eliminate surface-level vulnerabilities as their developers write and commit code, and they can use the same solutions to run deep scans later in the SDLC prior to deploying their applications.

Here is a breakdown of Rapid Scan's new capabilities:

Coverity Rapid Scan

This new feature provides a security analysis of proprietary code at the developer's desktop and in continuous integration (CI) pipelines such as GitLab and GitHub Actions. In addition, Coverity Rapid Scan is optimised for cloud-native applications built on infrastructure-as-code frameworks such as Kubernetes, Terraform, and CloudFormation, and micro-services such as GraphQL, Kafka, and Postman.

Rapid Scan can now detect many of the most common security weaknesses, as well as problematic misconfiguration flaws and API misuses.

Black Duck Rapid Scan

The Rapid Scan capabilities of Black Duck SCA allows developers to perform dependency analysis to determine if any of the open source components in their application violate any security and license policies before merging code into release branches.

Black Duck Rapid Scan is optimised for speed and efficiency by providing developers with early insight into dependency risk and by deferring resource-intensive SCA activities such as multi-factor open source detection and generating a complete software bill of materials to later stages of the SDLC.

Intelligent Orchestration and Rapid Scan

The Coverity and Black Duck Rapid Scan capabilities can be used with Synopsys' Intelligent Orchestration solution to trigger SAST automatically and SCA scans based on events in the continuous integration (CI) pipeline.

Intelligent Orchestration can leverage Rapid Scan at early stages in the pipeline when speed and efficiency are critical. It also can run full Coverity and Black Duck scans at later stages in the pipeline when validating the security of applications before deployment.