Using Static Analysis Tools to Become A Superhero Programmer
summary
Static analysis plus SCA find real problems fast: Semgrep found five issues in a six‑class Java app and is easy to add via a CLI or GitHub Action (scans take ~3–4 minutes); bytecode analysis gives higher accuracy and custom sanitizers but is slow and resource‑heavy (bytecode analysis is slower but more accurate). SBOMs are trivial to generate (example: SBOM generated with Docker Scout) but must be signed; Sonatype reports correcting 33% of NVD entries, Log4j still shows ~354M downloads, and EU/US rules soon force SBOMs and liability.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 2:43Understanding static analysis
- 5:20Source vs bytecode analysis
- 7:16Key analytical concepts
- 10:30Static analysis tools
- 12:50Semgrep demo
- 16:20Software composition analysis
- 20:25The state of cybercrime
- 24:20Legislation and security
- 29:17SBOMs and lifecycle demo
- 33:32Best practices for security
- 36:43Conclusion and resources
- 40:11Q&A session
related talks
54mA Shock to the System Static Analysis for Real AppSec
34mKeep your code safe during the development path using OS tools
58mSecurity Static Analysis - Avoiding an Angry Mob of Engineers
50mPractical Advanced Static Analysis
38mStatic Code Analysis - A Behind-the-scenes Look
16mAdvanced SAST: How to Secure AI-Generated Code
01h 03mSOAP - Keynote: Beyond Code: New Signals for Static Analysis
33mBattle Tested Application Security