[New Process Improvement Need]: Recommendations for automated security scans

[riverma]

Checked for duplicates

Yes - I've already checked

Category

Security - application, network, hardware, etc. security topics

Describe the need

We have a need for:

• Guidance for repository security scanning (+1'd by @ramesh-maddegoda)
• Automated source code quality scanning tools (E.g.: SonarCube)  to check the source code quality
• Automated static security scanning tools (E.g: HP Fortify, IBM AppScan) to check source code for security vulnerabilities
• Automated 3rd party dependency scanning tools (E.g: Back Duck) to ensure if the algorithms are not using known vulnerable open source libraries

[riverma]

+1'd by @ramesh-maddegoda, @jeffreypon, @pymonger

[riverma]

Duplicate? https://github.com/NASA-AMMOS/slim/issues/25

[riverma]

Closing this issue as #25 duplicates this.