Implement DISA STIG Rules with Polyspace Bug Finder

Polyspace Bug Finder is a static analysis tool that can help automate the implementation of a subset of STIG rules.

The Defense Information Systems Agency (DISA) has brought out many rules to enhance the security of DoD IA and IA-enabled devices/systems. These rules come in the form of the DISA Security Technical Implementation Guides (STIG). The STIG contains technical guidance to "lock down" information systems/software that might otherwise be vulnerable to a malicious computer attack.

Polyspace Bug Finder is a static analysis tool that can help automate the implementation of a subset of STIG rules. Polyspace can detect several kinds of security vulnerabilities in your code such as unsafe encryption functions, unintended privilege elevation, tainted data, and other security issues. Using the Polyspace Bug Finder checkers, you can check for violations of STIG rules in your code.

The attached document and spreadsheet contains a mapping from DISA STIG rules (version 5) and the way to use this mapping with Polyspace Bug Finder. It also contains a checkers activation file mapped to DISA STIG rules and a Review Scope to filter results allowing to display only those results that correspond to DISA STIG rules.