Static application security testing: Difference between revisions

Revision as of 09:59, 15 October 2020

Revision as of 10:01, 15 October 2020

Line 83:

}}</ref>.

Static analysis tools examine the text of a program syntactically. They look for a fixed set of patterns or rules in the source code. Theoretically, they can also examine a compiled form of the software. This technictechnique relies on [[instrumentation]] of the code to do the mapping between compiled components and source code components to identify issues.

Static analysis can be done manually inas a form of [[Code review|code review]] or [[Software audit review|auditing]] of the code for different purposes, including security. Although, but it is time-consuming <ref>

{{Cite journal

|last1=Chess|first1=B.

Line 96:

|publisher=IEEE

|doi=10.1109/MSP.2004.111

}}</ref>.

The precision of SAST tool is determined by its scope of analysis and techniques used to identify vulnerabilities. Different Level of analysis are: