topic Re: security-based code validation products? in Application Development and Automation Discussions

security-based code validation products?

JR_LM — Wed, 12 Sep 2007 18:51:22 GMT

My company is planning on using third-party ABAP development services and because if this, a concern has been raised about the risk of malicious code being inserted into delivered code.

The question has been raised -- Is there a product that can scan ABAP code looking for known vulnerabilities? Any pointers or suggestions are appreciated.

Thanks in advance.

Re: security-based code validation products?

Former Member — Wed, 12 Sep 2007 20:04:29 GMT

Hi Joseph,

Interesting question - I don't recall seeing anything on the market for this, though maybe someone in the ABAP forum may have a better idea.

A previous client in a similar situation went through code review to try and catch obvious stuff but that's not exactly infallible.

Good luck in finding a solution & let us know if you find anything.

Cheers

Alex

Re: security-based code validation products?

JimSpath — Fri, 14 Sep 2007 14:53:35 GMT

I've answered the same question on the asug.com site.

If you're an ASUG member, you can read the thread here:

http://www.asug.com/DiscussionForums/DiscussionForums/tabid/312/view/topic/postid/82753/ptarget/82753/Default.aspx

Briefly, perhaps try transaction SCI.

Jim