97 Things Every Application Security Professional Should Know

Chapter 45. Application Security Testing

David Lindner

In the ever-evolving landscape of software development, ensuring the security of applications has become paramount to combat the ever-shifting threat environment. Application security testing (AST) stands as a shield against the growing array of threats that seek to exploit vulnerabilities within software systems. Within the realm of AST there are three pivotal methodologies—SAST, DAST, and IAST. These methodologies all bolster an organization’s defense by assessing applications for vulnerabilities. Each offers advantages and limitations, contributing unique dimensions to security strategy. By understanding the nuances, organizations can ensure they are using the correct AST for their environments.

Static Application Security Testing

SAST involves analyzing source code or an application’s binary. SAST examines the codebase line by line, looking for security vulnerabilities. SAST can identify issues early in the development life cycle and provide developers with feedback to fix vulnerabilities before they make their way into the final product. SAST is especially effective at detecting issues related to code logic and design flaws.

Advantages of SAST:

• Early detection. SAST identifies vulnerabilities during the development phase, allowing developers to address issues before code is deployed.

• Automation. SAST tools can scan ...