Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite

Static analysis can help developers find security flaws early, but buying a scanner does not create an effective program. Mark Willis joins Chris and Robert to explain how he fits testing into the software development lifecycle and works with developers to make results useful. They discuss choosing tools for the actual codebase, tuning recurring false positives, and evaluating products before committing to them. The conversation weighs scan coverage against the pace of DevOps and considers when dynamic testing and a deeper penetration test are appropriate. Mark also describes finding developers who want to become security champions and helping them build their skills. The recurring theme is collaboration: useful testing depends on context, timely feedback, and respect for the people fixing the code.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Willis:
→ Mark Willis at RSA Conference

Mentioned in this episode:
→ OWASP
→ OWASP Testing Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Static analysis and developer collaboration with Mark Willis
01:12 Mark’s journey from development into security
07:19 Empathy for the people writing the code
10:42 Placing static analysis in the SDLC
14:23 Tuning tools and reducing false positives
16:27 Evaluating scanners before buying
19:20 Static analysis at DevOps speed
23:02 What dynamic scanners can and cannot do
28:05 Working within the testing and release window
31:13 Choosing applications for deeper penetration testing
33:43 Helping developers move into security
36:51 Learning with the OWASP Testing Guide