CEVA: DSP and AI Processors

The challenge: Enforcing coding standards and reducing license risk

For CEVA’s DevOps/Real-Time Development Manager Ori Leibovich, the challenge was twofold: he needed more-effective enforcement of coding standards and a reduction of license-related risk. Prompted by CEVA’s recent work on AI processors for system-onchip (SoC) designs within the automotive industry, Leibovich saw that CEVA’s security program needed to come into compliance with the industry’s strict security and safety requirements. Furthering the challenge, Leibovich reported that “CEVA’s software development [had] grown rapidly” in recent months, making an automated solution that could keep up with increasing development speeds especially critical.

With an already-mature security program in place, CEVA needed solutions that could fit seamlessly into existing development activities and tooling, and support current security efforts without slowing down or overcomplicating existing initiatives. Leibovich’s desire to meet automotive industry safety certifications led him to investigate a two-pronged upgrade to CEVA’s security program: a robust static application security testing (SAST) and software composition analysis (SCA) tools.

The solution: Black Duck SCA and Coverity SAST

CEVA elected to adopt Black Duck® SCA and Coverity® Static Analysis (SAST) into its existing development pipelines. Black Duck’s automated policy management makes it easy for teams to define policies for open source use, security risk, and license compliance up front, while automating enforcement across the entire software development life cycle (SDLC)—all with tools developers are already using. Coverity SAST, a fast, accurate, and highly scalable SAST solution, makes it easy for development and security teams to address security and quality defects early in the SDLC. They can effortlessly track and manage risk across their app portfolio and ensure compliance with security and coding standards.

The results: Effortless compliance and risk reduction

Effortless compliance with Coverity SAST

Complying with industry standards and regulations can be daunting, especially when finding and identifying code and ensuring its quality becomes progressively more difficult due to increasing development speeds. Knowing how to address violations after they are found can be even more daunting. Coverity SAST makes it easy to filter identified issues by category, view trend reports, prioritize remediation of vulnerabilities based on criticality, and most importantly, manage policy compliance across teams and projects.

CEVA was able to quickly integrate Coverity SAST into its CI/CD processes, and then demonstrate that it was satisfying industry regulation requirements. Leibovich found that Coverity SAST “increased code quality and security,” helped “find defects with a low false positive rate,” and “enforced coding standards like MISRA C and AUTOSAR C++.” Most importantly, Coverity SAST easily “integrated with [its] internally developed compiler,” meaning existing development activities were uninterrupted and unhindered by the addition of a new solution.

Reduced risk with Black Duck SCA

Without a complete picture of the code within an application portfolio—specifically open source—an organization risks exposing itself to security, license compliance, and code quality risks. License compliance violations can result in costly litigation or compromise an organization’s valuable intellectual property.

Black Duck SCA helped CEVA eliminate license compliance risk from its development environment. After investigating several tools, CEVA found that Black Duck SCA would be the easiest to integrate and the least disruptive to its thriving security program, while also delivering results right away. Leibovich said that Black Duck SCA “integrated open source identification and management within our SDLC” and helped “identify open source licenses in use”—all critical activities for minimizing risk associated with license noncompliance.

Black Duck helped CEVA bolster its security efforts and bring security into alignment with the quality of its solution offerings. And by increasing security and compliance efforts, CEVA has reinforced that customers can trust its products. Leibovich summarized the company’s new-found security posture, stating that “CEVA can show that we are working according to safety protocols, and we have no issues with customers due to open source usage. We can show code is going through a static analysis tool and [we] therefore [have] better-quality software. And we can show that CEVA is working according to safety protocols.”

Now, Coverity SAST and Black Duck SCA scans are initiated automatically within CEVA’s development pipelines. They are providing detailed reports that developers and managers can use to ensure security and compliance, allowing teams to focus on what they do best—developing the industry-leading processor and platform IP solutions they are known for.