Veracode User Experience
Use Cases and Deployment Scope
It is used across the organization. We are using it for static analysis of our code. We have selected the policy that requires our release code to minimize the level of security faults. Beside static analysis we use Software Composition Analysis and we found it very helpful in rectifying vulnerabilities from third-party libraries.
Pros
- Good integration with Jenkins and Visual Studio.
- Parsing the code well.
- It has good dashboard.
- SCA graphs for transitive dependencies are very useful in identifying the vulnerabilities.
Cons
- The main problem is slow speed of the scan - it took 11 weeks in one instance.
- The problem was ongoing for number of months and eventually they managed to slash the running time to one day. However, since than the running time usually takes 2-3 days as the scan always stop during the run.
- While SCA for Java works very well, there are number of issues on the C++ side. It can not recognize the libraries build by default from source code third-party vendors
- Especially newer version produces lots of False Positives
Most Important Features
- Thorough scan of our code.
- Integration with our release process.
- Accurate info about vulnerabilities in third-party libraries
Return on Investment
- At the moment due to very slow speed to the scan, we can not fully integrate it in our development process.
- However, we are using it for our release process.
- The analysis that Veracode software provides gives us and our client confidence that we are producing the secure code.
Alternatives Considered
GitHub
Other Software Used
Microsoft Office 2016 (discontinued), Microsoft Visual Studio, IntelliJ IDEA, Notepad++, Microsoft 365, Atlassian Jira
