Static code analysis (not to be confused with software composition analysis, which is also abbreviated as SCA) is a critical part of code review and valuation. But what is static code analysis?

Static code analysis (or simply static analysis) is the process of analyzing computer software without actually executing the underlying code. It’s akin to an actor reading a script, rather than actually performing the play. Static analysis is typically performed using automated tools; many of these tools are available for free under open source licensing, although some of these are specific to certain languages or types of analyses. SCA can be performed at various hierarchical levels of software: from analyzing individual statements all the way up to complete source code analysis between multiple programs. Depending on the goals of the user, static analysis can focus on a single type of analysis (such as ensuring that code is formatted to a company’s specific standards) or more thorough analysis (which might include analyzing code fragments, computing metrics, and detecting errors).

Let’s apply the principles and steps of SCA to another field to better understand the purpose behind this type of analysis.

Modern architects and engineers typically rely on software that examines their schematics for issues before a building or vehicle is ever “real.” They begin by planning their designs: using their experience and inspiration, they draft schematics of houses or vehicles. How does the architect know that their plan will produce a safe building that meets code and is structurally sound? How does the engineer know that their car will be aerodynamically stable and efficient? The software these professionals use during the planning stage helps them to measure quality and compliance in their design and allows them to more efficiently and efficiently make changes. Conversely, what if construction and manufacturing proceeded immediately after design? The building would be constructed, building inspections would occur, and the building could be tested for load-bearing capacity. Similarly for the engineer, a prototype vehicle could be manufactured and tested under actual road conditions. While this approach is possible, it could clearly result in expensive mistakes and long delays until the “finished” product was ready.

SCA provides similar benefits for software engineers by analyzing software without actually executing the application being analyzed. This is advantageous, as during the development stage it can uncover bugs, potential security vulnerabilities, maintainability issues, and compliance problems. Because static code analysis looks at the source code itself, it can point to the specific lines of code that need to be reviewed or modified. Additionally, static code analysis can be used quickly and automatically throughout the development process, unlike other methods that require complete, fully-functioning applications to produce results.

Privacy by design (PbD) should be a goal for every organization (and may even be required, as in the case of organizations subject to GDPR), and static code analysis is an important tool to achieve this. Static analysis can be used to alert developers to unencrypted or improperly encrypted data or to detect methods or functions that are not properly audited or logged.

Static code analysis is not a complete solution, however, as it does have blind spots. Many of these shortcomings are addressed through the use of dynamic code analysis. In our next post, we’ll examine dynamic code analysis and learn more about the role that static and dynamic code analysis play in information security, compliance, and due diligence of software and software companies.