Item: Veracode
Rating: 8
Author: Śrinivāsa Rao Kuruba

Use Cases and Deployment Scope

Veracode was used in our organisation by a few business units for Static Analysis Security Testing (SAST). It helps in finding software vulnerabilities in the code by scanning the binary derived objects of the source code written by developers, thus addressing the security aspects of the products the organisation is shipping to its customers.

Any aspect concerning the vulnerabilities of a software product is non-trivial and would be very costly if reported by the customers. Veracode helps find these beforehand, if the code (binaries) is scanned before being integrated into the product. With its wide variety of integrations, Veracode scanning can happen at any stages of the DevOps CI Pipeline, thereby facilitating the "shift left" mentality of finding defect/vulnerabilities in [the] code as early as possible in the software development life cycle.

Pros and Cons

Binary scanning. Veracode static analysis is based out of binaries derived from source code which is more accurate that just the pure source code scanning. This accuracy translates to less false positives in the defects reported, thereby saving time of developers in tackling the real issues.
Veracode being a SaaS platform reduces the IT burden on your organisation. No servers to worry about, no performance concerns, no storage expansion to plan ahead and no capacity/elasticity challenges to take care of on all the infra (compute, storage, networking).
Veracode platform is very quick to configure and very easy to use. It just takes a few minutes to setup an application profile and start scanning. It is particularly easy to use for modern programming languages like Java as the java binaries are optimal for scanning.
Learning - Veracode's eLearning portal is very good and has all the relevant training on various aspects of security and again is seamlessly available in the same platform/tenant where the teams scan.
Security Consultation - Very easy to get help within the platform itself for a security consultation which is invaluable for the first few scans. Veracode is probably one of the very few SAST solutions which has such easy provision to get security consultation.

There is an initial overhead on generating the binary artefacts for scanning. The binaries need to be loaded with debug symbols for Veracode to be able to trace the defect back to the file and line number. This is relatively easy for modern programming languages (e.g. Java) with latest build tools (e.g. maven/gradle) but can be quite challenging for languages which are platform specific (C/C++) and have dated build systems (e.g. make).
Entry Point Selection. After the binaries are uploaded for scanning, the Veracode platform analyses them (pre-scan) and provides a list of 'modules' to be selected for scanning. Only the points of entry of program execution need to be selected here, based on the application architecture. The 3rd party modules on which your code is dependent on need to be uploaded but not selected as entry points for execution. This typically needs some fine-tuning and teams take some iterations to optimise. This would need the product architect inputs which teams generally do not understand, as they treat scanning in general as a DevSecOps responsibility and only after scanning, the developers/architects pitch in. For Veracode, their inputs are needed even during the scanning, for the first few scans at least.
This is a both a pro and con. Veracode does not give any option to customise the scanning rules or tweak what it is scanning for. This makes for a much simpler setup but also gives no scope for creating an application-specific scanning profile. For instance, if I do not want Veracode to look for SQL injection for whatever reason, or if I want Veracode to only look for OWASP Top 10 vulnerabilities, I cannot configure.
Long scan times, specifically for C/C++ based product/app scans. Some of the scans for enterprise scale product in C/C++ used to take quite many hours, and at times a couple of days. There have been improvements in this during the course of our 3 years of usage but in general, scans take a long time to complete.

Return on Investment

Veracode was one of the few scanning tools adopted by almost every team in the couple of Business Units where it was recommended. In a way, it is the only scanning tool with complete adoption.
Veracode reports detailing vulnerabilities and the accompanying documentation/learning sections helped developers understanding security aspects of coding, driving a culture of not just writing working code, but [doing] it securely.
Veracode Analytics Dashboards helped the leadership have a bird's eye view of the security score/compliance of all the products in their Business Units.

Alternatives Considered

Micro Focus Fortify Static Code Analyzer, Synopsys Coverity Static Application Security Testing (SAST) and SonarQube

Earlier in our organisation, Fortify was used (formerly from HP but now owned by Micro Focus). The general consensus was that there was too much noise (false positives), taking a lot of time to find and then fix the real issues.

SonarQube is also used in our organisation but not as widely as Veracode was used, due to the former's more generic scope on quality rather than the laser sharp focus Veracode has on Vulnerabilities.

Owing to the overall company's directive and cost objectives, Coverity eventually succeeded Veracode as the recommended SAST application, but the choice was not on purely technical grounds.

Usability

- Almost no setup required and easy to configure
- Very easy to use, intuitive UI with integrated analytics and learning portals.
- Seamless to review the results, triage them, generate reports.
- Security progression of the product/application is tracked via successive scans.
- Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.

Support Rating

- Easy to create support cases, right from the platform itself instead of visiting any other website or customer support portal.
- Privilege to create the cases granted to all users of the platform by default instead of restricting to only the Admins.
- Responses/updates to the case very promptly given. Escalation channels available via the customer success managers.
- Delegation of the user-generated cases to the platform admins of the organisation very quickly done, the scope permitting.
- Security consultation, a form of support unique to Veracode, can be very easily availed post-scan.

Key Insights

Do you think Veracode delivers good value for the price?

Not sure

Are you happy with Veracode's feature set?

Yes

Did Veracode live up to sales and marketing promises?

Yes

Did implementation of Veracode go as expected?

Yes

Would you buy Veracode again?

Other Software Used

GitHub, Synopsys Coverity Static Application Security Testing (SAST), Black Duck, Jenkins, JFrog Artifactory, BlazeMeter Continuous Testing Platform, Rally Software (formerly CA Agile Central), SonarQube, FlexNet Code Insight

Likelihood to Recommend

Well Suited

Well suited for modern programming languages
Super good for organisations which do not have a big IT budget to spend on infrastructure
Veracode Security consultation is invaluable for teams/Business Units which do not have a dedicated security team
These culminate and make it ideal for a startup to quickly benefit from Veracode's setup leanness to get going on Security scanning

Less Appropriate

For scanning large legacy applications/software (huge code base, multiple platforms to build, platform specific languages used)

Usability Pros and Cons

Pros	Cons
Like to use Relatively simple Easy to use Technical support not required Well integrated Consistent Quick to learn Convenient Feel confident using Familiar	None

Easy Tasks

Easy to upload and scan without much setup/configuration
Easy to integrate with CI Orchestrators like Jenkins and IDEs like Eclipse/IntelliJ
Elegant and integrated platform for scanning, viewing results, triaging vulnerabilities, generating reports/dashboards and learning. The complete SAST workflow

Difficult Tasks

Entry point selection after the pre-scan
Identifying the warnings/errors in the modules after pre-scan
Exporting defects/vulnerabilities during the triaging of them (need to go the analytics section for flaw export)

Please log in to join the conversation

Chris Rhondeau
commented 3 years ago
Hi Srinivasa: Under Cons you mention the inability of Veracode to customize security policies. Actually, your Administrator or security team member does have the ability to customize the security settings. Therefore, you may exclude SQLi (why you'd want to do that isn't clear) or set it to an OWASP Policy. They have several out-of-the-box policies (CERT, SANS, PCI, Etc.) and then you can also customize the policies based upon your needs. They'll find every flaw/vuln that they can for each language and framework and then the policy acts as a filter to show the developers what to focus on fixing, so everything it finds is visible to both the developers and the security team. With respect to the compilation, adding debug symbols, and scan times it's worth mentioning that most teams grew up on scanning source code and on-prem. Having to compile binaries and add debug symbols may at first appear to be a Con, but the compiler optimizes the binary, removing dead/unused code, resulting in fewer False Positives/Negatives (<1%), and more accurate security scans. The taint analysis from source to sync provides much more insight into potential flaws/vulns in the code that source code scanning simply cannot. This makes it a significant PRO. Regarding scan times for C/C++ it often comes down to how complex the application you are running actually is and how well the packaging/compilation was optimized for security scanning, which should result in a reduction in subsequent scan times. Veracode has the ability to fingerprint what was previously submitted for scanning and "remember" it for future scans, so it can more quickly scan what's net-new in the code. Finally, Veracode has rolled-out its Pipeline scanner, which enables your Developers or DevOps engineers to get a quick scan on your code submission without the pre-scan feature or policy matching function. Mean times for scans are 90 seconds and you'll get the flaw type and severity. This should help dramatically reduce the scan times in conjunction with everything else mentioned above. Please reach out to your account team and in particular your Security Program Manager with any questions and thanks for sharing! Happy scanning.

Veracode - A non-binary review for the binary scanner

Modules Used

Overall Satisfaction with Veracode