Static code analysis is usually thought of in terms of preventing vulnerabilities from existing in code. And, it’s thought of in terms of things like memory leaks and tainted data.
But as businesses become more reliant than ever on software to drive their revenues, it is important to think about the damage these vulnerabilities can do to the bottom line.
So here, we present “5 Ways Static Code Analysis Can Save Your Business From Ruin,” as detailed by Walter Capitani, director of product management at Rogue Wave Software.
#1: Reputation
Think of the amount of money companies spend to establish their brand, by meeting criteria the public establishes for reliability and security, along with ease of use, emotional connection and more. Back in the day, before iPhones came to dominate that market, it was known that if you bought a BlackBerry, it was the most secure device on the market.
Yet Apple offered emotional bonds and a delightful user experience – and a camera – and has come to just about own that market. And since then, it has become a target for hackers. In 2016, a security flaw in Apple’s iMessage system enabled users to spoof addresses to gain access to data and have users believe they were interacting with trusted addresses when they weren’t.
“Static code analysis might have been able to tell Apple, ‘these inputs could have prevented a crash.’ Tainted data could cause the crash, but they were not scanning for tainted data in messaging,” Capitani said. “The number of times you have to update and fix software affects your reputation.”
While Apple might have enough goodwill built to avoid irreparable harm to its reputation, a steady stream of breaches and fixes will do damage. And a smaller company, without the history of providing thrilling experiences, will be damaged much more.
#2: Lost inventory
Capitani told of a breakdown of the point-of-sale system at Starbucks in 2015 that prevented them from making sales in all of the company-owned stores in the U.S. and Canada. Starbucks said it was due to a failure during a daily system refresh. Food has an expiration date, and if those kinds of breakdowns – caused by software bugs – last too long, the company has to trash its food inventory and suffer the losses.
“If the supply chain is interrupted by software, there’s a ripple effect that costs you money down the line,” he said.
#3. Lost sales
When Boeing was rolling out its 787 Dreamliner fleet of airplanes, it incurred a battery problem that grounded the fleet until the root cause of the problem could be determined. “Salespeople were in final negotiations for sales,” Capitani said, “and they might have had to make price concessions or lose the business altogether. Problems like that affect the sales cycle.”
#4. Legal issues
Earlier this year, Equifax lost a tremendous amount of data as the result of a software vulnerability discovered in their application. Since then, they’ve been sued for damaged by innocent third parties affected by the data loss. “This is significantly distracting to companies, who now are worrying about legal issues instead of doing their day job.” And that affects the bottom line.
#5. Reputation part 11: Unhappy customers
In late 2015, the NEST smart home company had problems with their thermostats not turning the heat on in winter. Aside from pipes freezing, people away on vacation might have left pets home that could succumb to the cold if it went on tool long. “In today’s world, one unhappy customer can create a huge amount of negative publicity,” Capitani explained. NEST has a range of products, and if a potential customer were to read about the thermostat, he might think twice about buying a security camera from the company.
All of the above examples involved software that was not secure, or implementing newer technologies without thoroughly testing it. “Why would a company add static code analysis to what they’re doing?” Capitani asked. “Think about the impact of software quality on these factors. We’re not talking about quality for quality’s sake.” Actually, the business is at stake.
