Contrast Security, JFrog, Sonar, Snyk, and Others Extend Functionality of Interoperability Standard for Software Analysis Tools
BOSTON, MA, USA, June 1, 2022 /EINPresswire.com/ -- Key cybersecurity companies from across the globe are joining OASIS Open to advance the newest version of the Static Analysis Results Interchange Format (SARIF) interoperability standard for detecting software defects and vulnerabilities. In today’s announcement, Contrast Security, JFrog, Sonar, and Snyk became the newest Sponsors of the SARIF Technical Committee (TC) alongside Cryptsoft, GrammaTech, and Microsoft. Other members of the SARIF TC include Bank of America, CIRCL, ForAllSecure, Micro Focus, MITRE, Northrop Grumman, sFractal Consulting, Veracode, and WhiteSource.
Software developers use a variety of analysis tools to assess the quality of their
programs. These tools report results which can indicate problems related to program qualities such as correctness, security, performance, compliance with contractual or legal requirements, compliance with stylistic standards, understandability, and maintainability. To form an overall picture of program quality, developers often need to aggregate the results produced by all of these tools. SARIF provides a common output format for software analysis tools that lets developers and teams understand, interact with, and manage the results produced by all their tools."The next major version of SARIF will expand our ability to aggregate data and detect vulnerabilities in some exciting new ways. We look forward to the contributions of the companies that are joining now, and we welcome others," said OASIS SARIF TC co-chairs, Luke Cartey of Microsoft and David Keaton.
The SARIF TC brings together major software companies, cybersecurity providers, government, security orchestration specialists, programmers, and consultants. Participation in the TC is open to all companies, nonprofit groups, governments, academic institutions, and individuals through membership in OASIS. As with all OASIS projects, archives of the Committee’s work are accessible to both members and non-members alike.
Support for SARIF
Contrast Security
"It is no surprise that SARIF has emerged as the industry standard for communicating vulnerabilities. The Contrast Security team is excited to join the SARIF Technical Committee and to share our experience and expertise in interactive testing, route intelligence, and software instrumentation to make SARIF an even more powerful way to enable communication and transparency around software security. While the Contrast Secure Code Platform natively supports SARIF, we’re looking forward to working with other leaders in the industry to find more innovative ways to help developers code more securely."
-– Jeff Williams, Co-Founder and Chief Technology Officer, Contrast Security
JFrog
"The recent rise in volume and sophistication of open-source software supply chain attacks has forced developers and DevOps teams to scramble for information sources and solutions they can trust. As a recognized CVE naming authority with a qualified security research team, JFrog welcomes the opportunity to share our expertise and best practices with SARIF to better enable developers with a single source of truth for software security concerns."
-– Stephen Chin, VP of Developer Relations, JFrog
Additional Information
OASIS SARIF TC: https://www.oasis-open.org/committees/sarif
About OASIS Open
One of the most respected, nonprofit open source and open standards bodies in the world, OASIS advances the fair, transparent development of open source software and standards through the power of global collaboration and community. OASIS is the home for worldwide standards in cybersecurity, blockchain, privacy, cryptography, cloud computing, IoT, urban mobility, emergency management, and other content technologies. Many OASIS standards go on to be ratified by de jure bodies and referenced in international policies and government procurement. www.oasis-open.org
No comments:
Post a Comment