- [Instructor] Code tests verify
that software is functioning properly,
and these tests are a critical step
in the development of secure code.
While code reviews play an important role
in software security,
reviews involve developers examining code
and inspecting it for defects.
Code tests go beyond code reviews
and use technology to assist in the code inspection process.
It's common for organizations to use both code tests
and code reviews on the same software
to gain different perspectives
on software quality and security.
There are two main types of code testing:
static tests and dynamic tests.
In a static code test,
developers use specialized testing software
to examine the code for common defects.
The code doesn't actually get executed during a static test,
but it is examined for common errors,
and those errors are reported as defects
that require correction.
You can think of static code tests
as the automated version of a code review.
In a dynamic code test,
the testing software actually executes the code.
It supplies input to the code
and then reads the code's output
to verify that the software is functioning properly.
This is the closest test to real-world operations
and is a valuable step
in preparing to move code to production,
providing both developers and managers
with confidence that the code is functioning properly.
Synthetic transactions are an important part
of dynamic code testing.
Synthetic transactions are scripted sets
of inputs and instructions that are given to code
when the testers know
what output the code should produce or each input.
Testing software can automatically cycle
through these synthetic transactions
to verify that the code is functioning properly
across a wide variety of tests.
We've talked about code reviews,
static tests, and dynamic tests.
Before we move on to some specific types of tests,
it's important to recognize that this is not a situation
where one type of test is better than another.
Static tests often identify defects that weren't included
in the synthetic transactions used by dynamic tests.
Dynamic tests often identify defects and functionality
that a static test can't foresee.
And the trained eye of a skilled developer
can pick out deficiencies
that escaped all of these automated tests
during a manual code review.
Code testing is an important component
of software development security.