Static application security testing: Difference between revisions

Revision as of 10:01, 15 October 2020

Revision as of 10:05, 15 October 2020

Line 84:

Static analysis tools examine the text of a program syntactically. They look for a fixed set of patterns or rules in the source code. Theoretically, they can also examine a compiled form of the software. This technique relies on [[instrumentation]] of the code to do the mapping between compiled components and source code components to identify issues.

Static analysis can be done manually as a [[Code review|code review]] or [[Software audit review|auditing]] of the code for different purposes, including security, but it is time-consuming.<ref>

{{Cite journal

|last1=Chess|first1=B.

Line 98:

}}</ref>

The precision of SAST tool is determined by its scope of analysis and the specific techniques used to identify vulnerabilities. Different Levellevels of analysis areinclude:

* [[Subroutine|function level]] - a sequencesequences of instruction.

* [[Class (computer programming)|file or class-level]] - an extensible program-code-template for creatingobject objectscreation.

* [[Application software|application level]] - a program or group of programs that might have interactions between theminteract.

The scope of analysis determines its accuracy and capacity in detecting vulnerabilities by using a wider contextual information<ref>

{{Cite journal