Developers are constantly under pressure to increase code output, but rushing through the development process can lead to problems without the proper controls and tooling.
Static code analysis (SCA) tools offer a way to verify quality, security, and compliance without adding too much extra time to the process. According to a webinar from Perforce, just because a developer has access to a tool doesn’t mean they are using it 100% effectively. 
In the webinar, Rod Cope, chief technology officer at Perforce Software, shared five things development teams can be doing to increase their development output using these tools:
According to Cope, many organizations lack the time, focus, and proper tools to prevent attacks. Further, most episodes relate to trust issues like cross-site scripting, SQL injection, or unvalidated inputs.
“Static code analysis can help by not requiring any additional time. You just run the tool,” said Cope.
Use SCA to enforce industry and coding standards.
SCA tools can enforce critical standards, such as DISA STIG, CWE, MISRA, CERT, SAME, OWASP, DO-1788, and FDA validation.
Cope recommends that even companies not in an industry that requires compliance with one of these standards still pick one and follow it. “We found it’s a best practice to adopt one of these standards, so at least you’re following something, and you know these standards are good, reliable, proven in the industry,” he said.
Integrate SCA and CI into your development process.
This helps reduce testing time because as developers write code, it gets scanned and verified in the context of the rest of the code. As a result, any security or compliance issues get caught immediately rather than closer to the end of the process, which would require developers to have to go back in and rework the code.
According to Cope, development teams using daily builds experience a 90% increase in output and a 36% reduction in defect rate when testing at each check-in point.
To work successfully in a CI environment, SCA tools must be automated, scalable, and efficient by analyzing the affected code and reporting only the relevant information for a given context, Cope explained.
Use SCA to validate legacy and open-source software.
Cope added that the SCA tool should scan all open-source components in use.
He also recommended that companies who use contractors to write code ask those contractors to run SCA on that code and report the results.
“The more you can upfront, the cheaper it is, and faster it is to fix those defects and to avoid issues,” said Cope.
Use SCA to help developers improve code quality.
SCA isn’t just a scanner for finding bugs; it can also be used as an educational tool. Developers can learn from the results to improve how they write code by learning about common programming errors, security vulnerabilities, and standards.
“As they create errors and the tool tells them what they did wrong, a good tool also tells them how to do it right, how to fix it, what is the underlying issue, how to avoid those issues in the future, how to write better clean code with fewer vulnerabilities,” said Cope.
Watch the webinar “5 Ways to Improve Developer Output.”
