Automatic detection of an incomplete static analysis security assessment

Abstract

Embodiments include method, systems and computer program products for automatic detection of an incomplete static analysis security assessment. In some embodiments, a method includes obtaining component versioning data associated with a build of an application. The method further includes determining, using the component versioning data associated with the build of the application, that a static analysis security assessment configuration of the application is incomplete. The method further includes, responsive to determining that the static analysis security assessment configuration of the application is incomplete, generating metadata indicating that at least a portion of the build of the application has been changed from a previous build of the application.

What is claimed: 
     
         1 - 7 . (canceled) 
     
     
         8 . A computer program product comprising a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
 obtaining component versioning data associated with a build of an application;   determining, using the component versioning data associated with the build of the application, that a static analysis security assessment configuration of the application is incomplete; and   responsive to determining that the static analysis security assessment configuration of the application is incomplete, generating metadata indicating that at least a portion of the new build of the application has been changed from a previous build of the application.   
     
     
         9 . The computer program product of  claim 8 , wherein obtaining the data associated with the new build of the application further comprises:
 receiving a notification from a continuous integration server that indicates a build of an application has been generated;   establishing a connection with a build product repository; and   obtaining the data associated with the build of the application using information from the notification.   
     
     
         10 . The computer program product of  claim 8 , wherein the notification comprises the data associated with the build of the application. 
     
     
         11 . The computer program product of  claim 8 , wherein the method further comprises:
 initiating a new static analysis security assessment associated with the application using the data associated with the build of the application.   
     
     
         12 . The computer program product of  claim 8 , wherein the data associated with the build of the application indicates that the application comprises an updated version of a component of the application. 
     
     
         13 . The computer program product of  claim 8 , wherein the method further comprises:
 generating an application portfolio comprising a plurality of static analysis security assessment configurations associated with a plurality of applications, wherein the plurality of applications comprises the application; and   updating the application portfolio using the metadata associated with the application.   
     
     
         14 . The computer program product of  claim 8 , wherein the method further comprises:
 receiving information from a source control server indicating that a change has been made affecting the static analysis security assessment configuration associated with the application;   generating an updated static analysis security assessment configuration associated with the application; and   initiating a new static analysis security assessment using the updated static analysis security assessment configuration associated with the application.   
     
     
         15 . A system, comprising:
 a processor in communication with one or more types of memory, the processor configured to:
 obtain component versioning data associated with a build of an application; 
 determine, using the component versioning data associated with the build of the application, that a static analysis security assessment configuration of the application is incomplete; and 
 responsive to determining that the static analysis security assessment configuration of the application is incomplete, generate metadata indicating that at least a portion of the build of the application has been changed from a previous build of the application. 
   
     
     
         16 . The system of  claim 15 , wherein, to obtain the data associated with the new build of the application, the processor is further configured to:
 receive a notification from a continuous integration server that indicates a build of an application has been generated;   establish a connection with a build product repository; and   obtain the data associated with the build of the application using information from the notification.   
     
     
         17 . The system of  claim 15 , wherein the notification comprises the data associated with the build of the application. 
     
     
         18 . The system of  claim 15 , wherein the processor is further configured to:
 initiate a new static analysis security assessment associated with the application using the data associated with the build of the application.   
     
     
         19 . The system of  claim 15 , wherein the data associated with the build of the application indicates that the application comprises an updated version of a component of the application. 
     
     
         20 . The system of  claim 15 , wherein the processor is further configured to: generate an application portfolio comprising a plurality of static analysis security assessment configurations associated with a plurality of applications, wherein the plurality of applications comprises the application; and
 updating the application portfolio using the metadata associated with the application.