Static application security testing: Difference between revisions

Revision as of 00:56, 30 January 2023

Revision as of 11:22, 8 July 2023

Line 1:

'''Static application security testing''' ('''SAST''') is used to secure software by reviewing the source code of the software to identify sources of vulnerabilities. Although the process of [[Static program analysis|statically analyzing the source code]] has existed as long as computers have existed, the technique spread to security in the late 90s and the first public discussion of [[SQL injection]] in 1998 when Web applications integrated new technologies like [[JavaScript]] and [[Adobe Flash Player|Flash]].

Unlike [[dynamic application security testing]] (DAST) tools for [[black-box testing]] of application functionality, SAST tools focus on the code content of the application, [[white-box testing]].

Line 19:

}}</ref>

In the [[Softwaresoftware development process|SDLClife cycle]] (SDLC), SAST is performed early in the development process and at code level, and also when all pieces of code and components are put together in a consistent testing environment. SAST is also used for software quality assurance.<ref>

{{Cite journal

|last1=Ayewah|first1=N.