Content deleted Content added
m Reworded for clarity: "of applications their release" is awkward and confusing. Added "conducted before their release" to clarify the purpose and timing of the tests. Changed "a combination of the two" to "which is a combination of the two" to make the sentence grammatically complete. |
m Minor writing enhancements and linking |
||
Line 1:
{{Short description|Software securing application}}
'''Static application security testing''' ('''SAST''') is used to secure [[software]] by reviewing
Unlike [[dynamic application security testing]] (DAST) tools for [[black-box testing]] of application functionality, SAST tools focus on the code content of the application, [[white-box testing]]. A SAST tool scans the source code of applications and their components to identify potential security vulnerabilities in their software and architecture. Static analysis tools can detect an estimated 50% of existing security vulnerabilities in tested applications.<ref>
{{Cite book
|last1=Okun|first1=V.
Line 37 ⟶ 35:
|publisher=IEEE
|doi=10.1109/MS.2008.130
}}</ref> even if the many resulting [[False positives and false negatives#False positive error|false
|last1=Johnson|first1=Brittany
|last2=Song|first2=Yooki
Line 60 ⟶ 58:
|pages=86–103
|publisher=Springer
}}</ref> SAST tools, like other security tools, focus on reducing the risk of downtime of applications or that private information stored in applications
▲SAST tools, like other security tools, focus on reducing the risk of downtime of applications or that private information stored in applications will not be compromised.
For the year of 2018, the Privacy Rights Clearinghouse database<ref>{{Cite web|url=https://privacyrights.org/data-breaches|title=Data Breaches | Privacy Rights Clearinghouse|website=privacyrights.org}}</ref> shows that more than 612 million records in the [[United States]] have been compromised by hacking.
==Overview==
Application security tests conducted before their release include static application security testing (SAST), [[dynamic application security testing]] (DAST), and [[interactive application security testing]] (IAST), which is a combination of the two.<ref name="auto1">
{{Cite book
|last1=Parizi|first1=R. M.
Line 84 ⟶ 81:
}}</ref>
Static analysis tools examine the text of a program syntactically. They look for a fixed set of patterns or rules in the source code. Theoretically, they can also examine a compiled form of the software. This technique relies on [[instrumentation]] of the code to do the mapping between compiled components and source code components to identify issues. Static analysis can be done manually as a [[code review]] or [[Software audit review|auditing]] of the code for different purposes, including security, but it is time-consuming.<ref>
{{Cite journal
|last1=Chess|first1=B.
Line 99 ⟶ 95:
}}</ref>
The precision of SAST
* [[Subroutine|
* [[Class (computer programming)|
* [[Application software|
The scope of the analysis determines its accuracy and capacity to detect vulnerabilities using contextual information.<ref>
{{Cite journal
Line 116 ⟶ 112:
|doi=10.1109/MSP.2004.55
|doi-access=free
}}</ref> SAST tools, unlike [[Dynamic application security testing|DAST]]
At a function level, a common technique is the construction of an [[Abstract syntax tree]] to control the flow of data within the function.<ref>
Line 135 ⟶ 131:
}}</ref>
Since the late 90s, the need to adapt to business challenges has transformed software development with componentization<ref>
{{Cite journal
|last1=Booch |first1=Grady
Line 159 ⟶ 155:
|journal=Information Systems Management
|doi=10.1201/1078.10580530/46108.23.3.20060601/93704.3
}}</ref> Following the flow of data between all the components of an application or group of applications allows validation of required calls to dedicated procedures for [[Code injection#Preventing problems|sanitization]] and that proper actions are taken to taint data in specific pieces of code.<ref>▼
▲Following the flow of data between all the components of an application or group of applications allows validation of required calls to dedicated procedures for [[Code injection#Preventing problems|sanitization]] and that proper actions are taken to taint data in specific pieces of code.<ref>
{{Cite journal
|last1=Livshits|first1=V.B.
Line 184 ⟶ 179:
}}</ref>
The rise of web applications entailed testing them: Verizon Data Breach
{{Cite book
|last1=Xianyong|first1=Meng
Line 212 ⟶ 206:
|pages=35–50
|url=https://computerresearch.org/index.php/computer/article/view/1780
}}</ref> SAST tools run automatically, either at the code level or application-level and do not require interaction. When integrated into a [[CI/CD]] context, SAST tools can be used to automatically stop the integration process if critical vulnerabilities are identified.<ref>▼
▲SAST tools run automatically, either at the code level or application-level and do not require interaction. When integrated into a CI/CD context, SAST tools can be used to automatically stop the integration process if critical vulnerabilities are identified.<ref>
{{Cite book
|last1=Okun|first1=V.
Line 230 ⟶ 223:
}}</ref>
SAST tools can offer extended functionalities such as quality and architectural testing. There is a direct correlation between
{{Cite conference
|last1=Siavvas|first1=M.
Line 251 ⟶ 243:
==SAST weaknesses==
Even though developers are positive about the usage of SAST tools, there are different challenges to
With [[Agile software development|Agile Processes]] in software development, early integration of SAST generates many bugs, as developers using this framework focus first on features and delivery.<ref>
{{Cite book
|last=Arreaza|first=Gustavo Jose Nieves
Line 266 ⟶ 258:
}}</ref>
Scanning many lines of code with SAST tools may result in hundreds or thousands of vulnerability warnings for a single application. It can generate many false
== See also ==
| |||