AAdesomoju418383 (Community Member) asked a question.
Customized Scan Policy for Batch Applications
Want to know if anyone has implemented a customized SAST scan policy for batch applications? The default scan policy seems to be generally for web application and this produces a lot of noise(FPs) if same policy is used to scan batch applications. Doing a new risk ranking for flaws in the new policy might be a good way of reducing the noise, any idea?
.png){kind=logo}
Hi @AAdesomoju418383 (Community Member) - thank you for reaching out with your question! I'll share your question with folks at the @Static Analysis Group (Archived) for visibility.
My opinion, the policy should be setup by business risk, not the type of application e.g. batch or otherwise should not matter, I would want to test for all possible flaws no matter what language the application is written in. For us we have the same VL policy for all our applications as they are applications we license to customers. The noise you speak of is normal, we have to weed through that noise every scan, just gets a little better every time.
There isn't anything that would stop you from implementing a "batch" policy scan, separate from your other policy scan types. How you craft that policy would depend on the business risk as stated by @mwaldis335267 (Community Member) .
Veracode will still find all flaws, but if all you want to know (or fix) are a subset, then you could make the policy in such a way that both reflects the risk and is applicable to batch jobs specifically. The developer would only mitigate flaws that impact the policy, instead of all of them.
For example, if a batch isn't going to have a UI then the policy shouldn't require a DAST scan to pass policy. Or maybe passing is to address critical flaws only, and develop a custom report that shows only critical flaws. Or exclude the score from the policy entirely.
In the end, no automated SAST tool can be FP free, but implementing a more appropriate policy would address your concerns and limit the amount of mitigations required for developers to look at ... as long as the risk is appropriately balanced with the new policy.