Checkmarx Security Testing Cheat Sheet: Comprehensive Guide to SAST Implementation

Introduction

Checkmarx is a leading Static Application Security Testing (SAST) platform that identifies security vulnerabilities in source code early in the software development lifecycle. By scanning code without execution, Checkmarx helps organizations prevent security flaws before deployment, reducing remediation costs and strengthening application security posture across multiple programming languages and frameworks.

Core Checkmarx Products

CxSAST (Static Application Security Testing)

• Primary Function: Source code analysis for security vulnerabilities
• Languages Supported: 30+ including Java, C#, PHP, Python, JavaScript, TypeScript
• Key Feature: Extensive custom query language for vulnerability detection

CxSCA (Software Composition Analysis)

• Primary Function: Identifies vulnerabilities in open-source components
• Detection Capabilities: License compliance, outdated libraries, known CVEs
• Key Feature: Comprehensive dependency mapping and impact analysis

CxIAST (Interactive Application Security Testing)

• Primary Function: Runtime vulnerability detection
• Deployment: Agent-based monitoring during QA/testing
• Key Feature: Zero-false-positive approach to vulnerability validation

CxCodebashing

• Primary Function: Developer security education platform
• Format: Interactive training modules tied to identified vulnerabilities
• Key Feature: Just-in-time learning integrated with scan results

Checkmarx Implementation Process

1. Installation and Configuration

• On-premises Option: Server installation with database configuration
• Cloud Option: SaaS implementation with access control setup
• Infrastructure Requirements: Adequate CPU, memory, storage for codebase size
• Authentication: LDAP/Active Directory integration options

2. Project Setup

• Create project structure matching application architecture
• Configure language-specific settings
• Define scan presets based on security requirements
• Establish baseline for incremental scanning

3. Scan Policy Configuration

• Preset Selection: Choose security standards (e.g., OWASP Top 10, PCI DSS)
• Custom Rule Creation: Develop organization-specific queries
• Severity Definitions: Configure risk levels appropriate to organization
• Exclusion Management: Document legitimate false positive handling

4. Integration Options

• CI/CD Pipeline: Jenkins, Azure DevOps, GitLab CI, GitHub Actions
• Issue Tracking: JIRA, Azure DevOps, GitHub Issues
• Source Control: Git, SVN, TFS
• Development Environment: IDE plugins for Visual Studio, Eclipse, IntelliJ

Key Checkmarx Commands and Operations

CxCLI Commands (Command Line Interface)

# Scan initiation
CxCLI Scan -ProjectName "MyProject" -CxServer "https://checkmarx-server" -CxUser "username" -CxPassword "password" -LocationType folder -LocationPath "C:\source"

# Scan with specific preset
CxCLI Scan -ProjectName "MyProject" -Preset "High" -LocationType git -LocationURL "https://github.com/myrepo/myproject.git"

# Generate PDF report
CxCLI GenerateReport -ProjectName "MyProject" -ReportType PDF -ReportFile "report.pdf"

# Check scan status
CxCLI GetStatus -ProjectName "MyProject"

REST API Examples

# Authentication
POST /cxrestapi/auth/identity/connect/token
Content-Type: application/x-www-form-urlencoded
grant_type=password&username=user&password=pass&scope=sast_rest_api

# Create new project
POST /cxrestapi/projects
Authorization: Bearer {token}
Content-Type: application/json
{"name":"New Project","owningTeam":"Team A","customFields":{}}

# Trigger scan
POST /cxrestapi/sast/scans
Authorization: Bearer {token}
Content-Type: application/json
{"projectId":1000,"isIncremental":false,"forceScan":true,"comment":"CI scan"}

Understanding Checkmarx Results

Severity Levels

• High: Critical vulnerabilities requiring immediate attention
• Medium: Significant vulnerabilities that should be prioritized
• Low: Less critical issues that should be addressed when possible
• Information: Best practice recommendations, not security vulnerabilities

Query Categories

Vulnerability Analysis

• Source: Where user input or sensitive data enters the application
• Sink: Where the vulnerability can be exploited
• Sanitizer: Code that validates or cleanses data, preventing exploitation
• Data Flow: The path from source to sink showing vulnerability propagation

Best Practices for Checkmarx Implementation

Scan Optimization

• Configure incremental scans for faster results during development
• Schedule full scans at significant milestones
• Use exclude patterns for generated/test code
• Implement custom file extension mappings for non-standard files

False Positive Management

• Document justifications for false positive markings
• Create custom queries to reduce common false positives
• Use sanitizer patterns to identify proper validation
• Implement team review process for false positive verification

DevSecOps Integration

• Run lightweight scans on pull requests
• Block merges for high-severity issues
• Generate security reports alongside build artifacts
• Implement automated ticketing for critical vulnerabilities

Remediation Workflow

1. Prioritize vulnerabilities by risk impact and exploitability
2. Assign issues to appropriate development teams
3. Provide remediation guidance through CxCodebashing
4. Verify fixes with incremental scan validation
5. Track remediation metrics over time

Common Checkmarx Challenges & Solutions

Advanced Checkmarx Techniques

Custom CxQL (Checkmarx Query Language)

// Sample SQL Injection query
CxList inputs = Find_Inputs();
CxList sqls = Find_SQL_Executions();
result = inputs.DataInfluencingOn(sqls);

Query Optimization Strategies

• Use specific Find_* methods rather than generic ones
• Leverage caching for repeated expressions
• Apply filters before expensive operations
• Break complex queries into manageable components

Custom Sanitizer Definitions

// Define custom sanitizer for Input validation
CxList validators = All.FindByMemberAccess("StringValidator.IsValid");
sanitize(inputs, validators);

Vulnerability Modeling

• Create proof-of-concept exploits to validate true positives
• Document vulnerability patterns specific to your applications
• Develop custom libraries of known-good implementation patterns

Integration Reference

Jenkins Pipeline Integration

pipeline {
    agent any
    stages {
        stage('Checkmarx Scan') {
            steps {
                step([$class: 'CxScanBuilder',
                    projectName: '${JOB_NAME}',
                    preset: '36', // High preset
                    fullScanCycle: 10,
                    incrementalScan: true,
                    comment: 'Jenkins build ${BUILD_NUMBER}',
                    jobStatusOnError: 'UNSTABLE',
                    vulnerabilityThresholdEnabled: true,
                    highThreshold: 0,
                    mediumThreshold: 10,
                    lowThreshold: 99999
                ])
            }
        }
    }
}

GitHub Actions Integration

name: Checkmarx SAST Scan
on: [push, pull_request]
jobs:
  checkmarx-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Checkmarx CxFlow Action
        uses: checkmarx-ts/checkmarx-cxflow-github-action@v1.0
        with:
          project: GithubActionTest
          team: CxServer
          checkmarx_url: ${{ secrets.CHECKMARX_URL }}
          checkmarx_username: ${{ secrets.CHECKMARX_USERNAME }}
          checkmarx_password: ${{ secrets.CHECKMARX_PASSWORD }}
          checkmarx_client_secret: ${{ secrets.CHECKMARX_CLIENT_SECRET }}

Compliance & Standards Integration

Mapping to Security Standards

• OWASP Top 10: Built-in presets for latest OWASP categories
• PCI DSS: Requirements 6.5.x coverage for secure coding
• HIPAA: Technical safeguards for PHI protection
• GDPR: Personal data protection controls

Audit & Reporting

• Generate compliance evidence through attestation reports
• Document security gates and enforcement mechanisms
• Track vulnerability remediation timelines
• Produce trend analysis for security posture improvement

Resources for Further Learning

• Official Documentation: Checkmarx Knowledge Center
• Training: Checkmarx Academy portal for certified training
• Community: Checkmarx User Group forums and discussions
• Webinars: Regular product updates and best practices sessions
• GitHub: Checkmarx Sample Projects
• Blog: Checkmarx AppSec Blog

Final Thoughts

Effective Checkmarx implementation requires balancing security thoroughness with development velocity. By properly configuring scans, managing false positives, and integrating seamlessly into development workflows, organizations can maximize the security value while minimizing friction. Remember that tool implementation is only one component of a comprehensive application security program, which should include developer education, secure coding practices, and multiple testing methodologies.