Security Standards

Klocwork is about helping developers write secure code. That's why our analysis has been tuned to detect security vulnerabilities specifically identified by the leading authorities on secure coding best practices. We offer the most comprehensive coverage for MISRA standards as well as other secure coding initiatives including CWE, CERT, SAMATE, DISA STIG and OWASP.

Learn more

Industry Standards

As the go-to static analysis vendor in the embedded space, Klocwork's tools play an important role in achieving compliance with the following industry standards:

• FDA Software Validation: Klocwork Insight addresses key validation requirements as they relate to the software coding phase outlined in the FDA's General Principles of Software Validation.
• DO-178B Certification: Helping developers of airborne systems obtain FAA approval of their software, our tools can assist with addressing Software Verification and Software Lifecycle Data objectives outlined by the DO-178B guidance.
• ISO 26262 Compliance: Klocwork's technology can help support the ISO 26262 compliance goals of automotive OEMs and their suppliers as they relate to product development at the software level.

General Coding Standards

In addition to support for formal, published standards, Klocwork Insight provides out-of-the-box support for general coding practices recommended by regulatory bodies, industry consortiums and individual companies that are serious about software quality discipline. While these various standards differ in many ways, most recommend the following general guidelines, which are supported by Klocwork:

• Ban explicit language features that can hide coding errors
• Eliminate multiple declarations in functions, classes, data types, macros, variables, etc.
• Only use pointer expressions after initialized
• Only include header files once
• Eliminate unused or unreachable code
• Place limits on the complexity of the software functions

Create Your Own Checkers

Need to implement standards unique to your project or business? Our product extensibility allows you to add checkers that meet your specific needs using one of two language frameworks:

• Klocwork Abstract Syntax Tree (KAST) checkers are used for finding syntax-related issues or any kind of style/coding guideline. KAST operates off the abstract syntax tree that is automatically generated in a hierarchical fashion to locate code constructs.
• Path checkers search for control-flow and data-flow issues, including issues spanning multiple functions or files (inter-procedurally), and allow you to track a value from a source (a starting point for analysis) to a sink (the end point where the defect is detected).

Development of most custom checkers can be done within the Klocwork Checker Studio, a graphical environment that allows developers to easily write new checkers that query their code's AST.