Static application security testing: Difference between revisions

Revision as of 09:42, 15 October 2020

Revision as of 09:46, 15 October 2020

Line 246:

==SAST weaknesses==

Even though developers are positive about the usage of SAST tools, there are different challenges withto the adoption of SAST tools by developers.<ref name="auto"/>.

With the development of Agile Processes intoin software development, theearly integration of SAST earlygenerates inmany thebugs, processas resultsdevelopers inusing manythis problems as developersframework focus first on features and delivering somethingdelivery.<ref>

{{Cite journal

|last=Arreaza|first=Gustavo Jose Nieves

Line 258:

|doi=10.1109/CSCloud/EdgeCom.2019.00-11

|isbn=978-1-7281-1661-7

}}</ref>.

Scanning a large amount of line of code with SAST tools may result in hundreds or thousands of vulnerability warnings for a single application. It generates a large number of false-positives increasing the investigation time and reducing the trust in such tools. This is particularly the case when the context of the vulnerability cannot be caught by the tool<ref>