Content deleted Content added
→Overview: cbutce Tags: Mobile edit Mobile web edit Advanced mobile edit |
m Minor writing enhancements and linking |
||
| (39 intermediate revisions by 28 users not shown) | |||
Line 1:
{{Short description|Software securing application}}
'''Static application security testing''' ('''SAST''') is used to secure [[software]] by reviewing its [[source code]] to identify security vulnerabilities. Although the process of [[Informal methods of validation and verification#Desk checking|checking programs by reading their code]] (modernly known as [[Static program analysis|static program analysis]]) has existed as long as computers have existed, the technique spread to security in the late 90s and the first public discussion of [[SQL injection]] in 1998 when [[Web application|web applications]] integrated new technologies like [[JavaScript]] and [[Adobe Flash Player|Flash]].
Unlike [[dynamic application security testing]] (DAST) tools for [[black-box testing]] of application functionality, SAST tools focus on the code content of the application, [[white-box testing]]. A SAST tool scans the source code of applications and their components to identify potential security vulnerabilities in their software and architecture. Static analysis tools can detect an estimated 50% of existing security vulnerabilities in tested applications.<ref>
{{Cite book
|last1=Okun|first1=V.
|last2=Guthrie|first2=W. F.
|last3=Gaucher|first3=H.
|last4=Black|first4=P. E.
|title=Proceedings of the 2007 ACM workshop on Quality of protection
|chapter=Effect of static analysis tools on software security: Preliminary investigation
|s2cid=6663970
|date=October 2007
|pages=1–5
|publisher=ACM
|doi=10.1145/1314257.1314260
|isbn=978-1-59593-885-5
|chapter-url=https://samate.nist.gov/docs/SA_tool_effect_QoP.pdf
}}</ref>
In the [[
{{Cite journal
|last1=Ayewah|first1=N.
Line 35:
|publisher=IEEE
|doi=10.1109/MS.2008.130
}}
|last1=Johnson|first1=Brittany
|last2=Song|first2=Yooki
|last3=Murphy-Hill|first3=Emerson
|last4=Bowdidge|first4=Robert
|title=2013 35th International Conference on Software Engineering (ICSE)
|chapter=Why don't software developers use static analysis tools to find bugs?
|date=May 2013
|pages=672–681
|doi=10.1109/ICSE.2013.6606613
|isbn=978-1-4673-3076-3
}}</ref>
SAST tools are integrated into the development process to help development teams as they are primarily focusing on developing and delivering software respecting requested specifications.<ref name="auto">
{{Cite journal
|last1=Oyetoyan|first1=Tosin Daniel
Line 59 ⟶ 58:
|pages=86–103
|publisher=Springer
}}</ref> SAST tools, like other security tools, focus on reducing the risk of downtime of applications or that private information stored in applications is not compromised.
For the year of 2018, the Privacy Rights Clearinghouse database<ref>{{Cite web|url=https://privacyrights.org/data-breaches|title=Data Breaches | Privacy Rights Clearinghouse|website=privacyrights.org}}</ref> shows that more than 612
==Overview==
Application security tests
{{Cite
|last1=Parizi|first1=R. M.
|last2=Qian|first2=K.
Line 73 ⟶ 71:
|last4=Wu|first4=F.
|last5=Tao|first5=L.
|title=2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC)
|chapter=Benchmark Requirements for Assessing Software Security Vulnerability Testing Tools
|s2cid=52055661
|date=July 2018
|pages=825–826
|publisher=IEEE
|doi=10.1109/COMPSAC.2018.00139
|isbn=978-1-5386-2666-5
}}</ref>
Static analysis tools examine the text of a program syntactically. They look for a fixed set of patterns or rules in the source code. Theoretically, they can also examine a compiled form of the software. This technique relies on [[instrumentation]] of the code to do the mapping between compiled components and source code components to identify issues. Static analysis can be done manually as a [[code review]] or [[Software audit review|auditing]] of the code for different purposes, including security, but it is time-consuming.<ref>
{{Cite journal
|last1=Chess|first1=B.
Line 98 ⟶ 95:
}}</ref>
The precision of SAST
* [[Subroutine|
* [[Class (computer programming)|
* [[Application software|
The scope of the analysis determines its accuracy and capacity
{{Cite journal
|last1=Chess|first1=B.
Line 114 ⟶ 111:
|publisher=IEEE
|doi=10.1109/MSP.2004.55
|doi-access=free
}}</ref> SAST tools, unlike [[Dynamic application security testing|DAST]] tools, give developers real-time feedback, and help them secure flaws before they move the code to the next level.
{{Cite
|last1=Yamaguchi|first1=Fabian
|last2=Lottmann|first2=Markus
|last3=Rieck|first3=Konrad
|title=Proceedings of the 28th Annual Computer Security Applications Conference
|chapter=Generalized vulnerability extrapolation using abstract syntax trees
|s2cid=8970125
|date=December 2012
|volume=2
|issue=4
Line 130 ⟶ 128:
|publisher=IEEE
|doi=10.1145/2420950.2421003
|isbn=9781450313124
}}</ref>
Since the late 90s, the need
{{Cite journal
|last1=Booch |first1=Grady
Line 139 ⟶ 138:
|date=September 1998
|title=Component-Based Software Engineering
|pages=34–36
|volume=15
|issue=5
|
|doi=10.1109/MS.1998.714621
}}</ref> enforced by processes and organization of development teams.<ref>
{{Cite journal
|last1=Mezo |first1=Peter
Line 152 ⟶ 150:
|date=December 2006
|title=Agile Software Development: Adaptive Systems Principles and Best Practices
|pages=19–30
|volume=23
|issue=3
|
|doi=10.1201/1078.10580530/46108.23.3.20060601/93704.3
}}</ref> Following the flow of data between all the components of an application or group of applications allows validation of required calls to dedicated procedures for [[Code injection#Preventing problems|sanitization]] and that proper actions are taken to taint data in specific pieces of code.<ref>
{{Cite journal
|last1=Livshits|first1=V.B.
Line 169 ⟶ 165:
| volume=14
}}</ref><ref>
{{Cite
|last1=Jovanovic |first1=N.
|last2=Kruegel |first2=C.
|last3=Kirda|first3=E.
|title=2006 IEEE Symposium on Security and Privacy (S&P'06)
|chapter=Pixy: A static analysis tool for detecting Web application vulnerabilities
|s2cid=1042585
|date=May 2006
|pages=359–368
|publisher=IEEE
|doi=10.1109/SP.2006.29
|isbn=0-7695-2574-1
}}</ref>
The rise of web applications entailed testing them: Verizon Data Breach reported in 2016 that 40% of all data breaches use web application vulnerabilities.<ref name=DBI_1>{{cite web| title=2016 Data Breach Investigations Report| url=https://www.verizon.com/business/resources/Ta80/reports/DBIR_2016_Report.pdf| publisher=[[Verizon]]| date=2016| access-date=8 January 2016}}</ref> Both external security validations and a focus on internal threats have risen. The Clearswift Insider Threat Index (CITI) has reported that 92% of their respondents in a 2015 survey said they had experienced IT or security incidents in the previous 12 months and that 74% of these breaches were originated by insiders.<ref name=CITI_2>{{cite web| title=Clearswift report: 40 percent of firms expect a data breach in the Next Year| url=https://www.securityinfowatch.com/cybersecurity/information-security/press-release/12141612/clearview-clearswift-report-40-percent-of-firms-expect-a-data-breach-in-the-next-year| publisher=Endeavor Business Media| date=20 November 2015| access-date=8 January 2024}}</ref><ref name=CITI_1>{{cite web| title=The Ticking Time Bomb: 40% of Firms Expect an Insider Data Breach in the Next 12 Months| url=https://www.clearswift.com/resources/press-releases/ticking-time-bomb-40-firms-expect-insider-data-breach-next-12-months| publisher=Fortra| date=18 November 2015| access-date=8 January 2024}}</ref> Lee Hadlington categorized internal threats in 3 categories: malicious, accidental, and unintentional. Mobile applications' explosive growth implies securing applications earlier in the development process to reduce malicious code development.<ref>
{{Cite book
|last1=Xianyong|first1=Meng
|last2=Qian|first2= Kai
Line 191 ⟶ 186:
|last4=Bhattacharya|first4= Prabir
|last5=Wu|first5=Fan
|title=2018 International Symposium on Networks, Computers and Communications (ISNCC)
|chapter=Secure Mobile Software Development with Vulnerability Detectors in Static Code Analysis
|s2cid=53288239
|date=June 2018
|pages=1–4
|doi=10.1109/ISNCC.2018.8531071
|isbn=978-1-5386-3779-1
}}</ref>
==SAST strengths==
Line 207 ⟶ 202:
|title= Rework and Reuse Effects in Software Economy
|journal=Global Journal of Computer Science and Technology
|volume=18
|issue=C4
|pages=35–50
|url=https://computerresearch.org/index.php/computer/article/view/1780
}}</ref> SAST tools run automatically, either at the code level or application-level and do not require interaction. When integrated into a [[CI/CD]] context, SAST tools can be used to automatically stop the integration process if critical vulnerabilities are identified.<ref>
{{Cite book
|last1=Okun|first1=V.
|last2=Guthrie|first2=W. F.
|last3=Gaucher|first3=H.
|last4=Black|first4=P. E.
|title=Proceedings of the 2007 ACM workshop on Quality of protection
|chapter=Effect of static analysis tools on software security: Preliminary investigation
|s2cid=6663970
|date=October 2007
|pages=1–5
|publisher=ACM
|doi=10.1145/1314257.1314260
|isbn=978-1-59593-885-5
|chapter-url=https://samate.nist.gov/docs/SA_tool_effect_QoP.pdf
}}</ref>
SAST tools can offer extended functionalities such as quality and architectural testing. There is a direct correlation between
{{Cite conference
|last1=Siavvas|first1=M.
|last2=Tsoukalas|first2=D.
Line 240 ⟶ 237:
|date=August 2019
|title= An Empirical Evaluation of the Relationship between Technical Debt and Software Security
|editor=Konjović, Z. |editor2=Zdravković, M. |editor3=Trajanović, M.
|
|doi=10.5281/zenodo.3374712 |doi-access=free |type=Data set
}}</ref>
==SAST weaknesses==
Even though developers are positive about the usage of SAST tools, there are different challenges to their adoption.<ref name="auto"/> As an example, research shows that despite the long output generated by these tools, they may lack usability.<ref>{{cite book |last1=Tahaei |first1=Mohammad |last2=Vaniea |first2=Kami |last3=Beznosov |first3=Konstantin (Kosta) |last4=Wolters |first4=Maria K |title=Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems |chapter=Security Notifications in Static Analysis Tools: Developers' Attitudes, Comprehension, and Ability to Act on Them |date=6 May 2021 |pages=1–17 |doi=10.1145/3411764.3445616|isbn=9781450380966 |s2cid=233987670 |url=https://www.research.ed.ac.uk/en/publications/e1bc04ef-ae83-4e82-8ade-ca572bc503d2 }}</ref>
With [[Agile software development|Agile Processes]] in software development, early integration of SAST generates many bugs, as developers using this framework focus first on features and delivery.<ref>
{{Cite
|last=Arreaza|first=Gustavo Jose Nieves
|title=2019 6th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)/ 2019 5th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom)
|chapter=Methodology for Developing Secure Apps in the Clouds. (MDSAC) for IEEECS Confererences
|date=June 2019
|pages=102–106
|publisher=IEEE
|doi=10.1109/CSCloud/EdgeCom.2019.00-11
|isbn=978-1-7281-1661-7
|s2cid=203655645
}}</ref>
Scanning many lines of code with SAST tools may result in hundreds or thousands of vulnerability warnings for a single application. It
== See also ==
* [[Security testing]]
* [[Lint (software)]]
* [[Dynamic application security testing]]
* [[Interactive application security testing]]
* [[Static program analysis]]
==References==
{{reflist}}
[[Category:
[[Category:
| |||