Which of the following application tests analyzes a running application for vulnerabilities?

As digital transformation accelerates and more organizations use software solutions to facilitate work operations, security threats have become more commonplace. Cybercriminals tirelessly develop ways to exploit software application vulnerabilities to target organizational networks. A notable example is the 2017 Equifax data breach, which exposed the personal details of 145 million Americans.

Development teams cannot rely on just one type of testing to prevent these breaches and keep applications secure. Your team should consider all the available strategies and combine them to provide the most coverage possible, in a way that best suits your workflow. In your quest to secure your code and your customers’ information, look beyond the most common testing methods.

Functional testing, which consists of unit and integration tests, is a great place to start, as is end-to-end testing. Functional testing is helpful, but it only checks for problems you thought of in advance, and is focused on meeting business objectives. It does not check for security flaws leading to data breaches.

There are other testing tools that fill gaps left by the most common test methods. Two of these are static application security testing (SAST) and dynamic application security testing (DAST). This article explores each type and discusses when to use SAST or DAST. Then, it highlights other forms of application testing you can implement to increase your application’s security.

What is SAST?

Static application security testing analyzes program source code to identify security vulnerabilities. These vulnerabilities include SQL injection, buffer overflows, XML external entity (XXE) attacks, and other OWASP Top 10 security risks.

SAST is open box testing. It scans the software application from the inside out to discover security vulnerabilities in the code before compilation or execution.

The SAST methodology guides developers to begin testing their application at early development stages without executing a functional component. This approach discovers application source code security flaws early and avoids leaving security issues to later development phases. This decreases development time and enhances overall program security.

SAST testing tools

Two of the most popular SAST testing tools are:

• Klocwork, a static code analyzer for C, C++, C#, Java, JavaScript, and Python.
• Checkmarx, a tool that supports multiple programming languages.

To mitigate serious security errors and produce more secure applications, many developers now incorporate SAST testing into their continuous integration and continuous deployment (CI/CD) pipelines. There are many use cases for using SAST to create more secure applications.

When can I use SAST?

Here’s an example: SAST can continually monitor source code vulnerabilities for problematic coding patterns that violate software development security best practices. It can also automate testing your application code for a range of vulnerabilities using popular security industry standards, like OWASP Top 10 and SANS Top 25. SAST supports compliance with data protection laws, like the Health Insurance Portability and Accountability Act (HIPAA), and the Payment Card Industry Data Security Standard (PCI DSS).

What is DAST?

Dynamic application security testing evaluates a software application. DAST testing simulates the actions of a malicious actor trying to break into your application remotely. DAST scans software applications in real-time against leading vulnerability sources, like the OWASP Top 10 or SANS/CWE 25, to find security flaws or open vulnerabilities.

The main difference between DAST and SAST lies in how each performs the security testing. SAST scans the application code at rest to discover faulty code posing a security threat, while DAST tests the running application and has no access to its source code.

DAST is a form of closed box testing, which stimulates an outside attacker’s perspective. It assumes the tester does not know the application’s inner functions. It can detect security vulnerabilities that SAST cannot, such as those that appear only during the program runtime.

Because DAST tests require a complete working application, reserve them for a later phase in your application development process. Testers need to interact with the application: provide inputs, check outputs, and simulate other actions typical of user interactions. These tests help ensure the application is not susceptible to web attacks such as cross-site scripting (XXS) or SQL injection.

Start with an open-source DAST tool

While most DAST tools are commercial, Arachni is an open source tool that provides rich functionality. Arachni’s Ruby framework supports scanning web applications for vulnerabilities including XSS (with DOM variants), SQL injection, NoSQL injection, code injection, and file inclusion variants. It can be helpful to try this free tool before deciding which commercial DAST tool to purchase later.

When should I use DAST?

DAST is useful for detecting misconfiguration in servers or databases that affect web application security during runtime. It can also catch authentication and encryption issues allowing unauthorized access, which SAST cannot. Also, DAST can test other API or web services your web application connects to, in addition to IT infrastructure resources like networking and data storage. So, DAST is valuable for testing the entire IT environment where your application or web services operate.

SAST vs. DAST: which should you use?

Now that you know the main characteristics and objectives of SAST and DAST testing methodologies, let’s discuss which one is best suited to your application testing environment. Organizations should not choose one or the other, but instead, apply both methods to testing applications.

SAST tests the application’s internal source code in early development phases to ensure developers follow the best security practices when writing code. In contrast, DAST testing begins in later development phases in a working application. It tests the application while it’s running to discover its susceptibility to the most common cyber threats.

SAST testing is technology-dependent. So, your SAST tool should support your programming language and development framework to ensure complete testing coverage. On the other hand, DAST is technology-independent because it tests the application in runtime from an external user perspective.

To achieve maximum security for your software application, consider integrating SAST and DAST tooling as part of the app’s CI/CD pipeline. DevSecOps should use both methodologies to integrate security into each development phase. This approach helps development teams integrate security controls into their design process without impacting productivity. Automating SAST and DAST scans with CI/CD accelerates development time without sacrificing the final product’s safety.

Other forms of application security (IAST, RASP, and HAST)

SAST and DAST are not the only available testing methods. The development community also uses variations like IAST, RASP, and HAST.

Interactive application security testing

Interactive application security testing (IAST) is a testing methodology that combines the functions of both SAST and DAST. It uses a monitoring mechanism (sensor or agent) in the application’s backend to gather information during runtime.

This approach lets developers test their application’s behaviors at runtime using DAST testing techniques while still monitoring source code execution, like SAST testing. IAST mitigates a significant limitation of the SAST methodology: its inability to follow and test all dependencies, like libraries and frameworks, that modern web applications use.

Runtime application self-protection (RASP)

Runtime application self-protection (RASP) tests and protects applications against common vulnerabilities during execution or runtime. DevOps can use RASP to monitor applications in production and take corrective steps when it detects abnormal activity, such as a cyberattack or other malicious action.

Hybrid application security testing (HAST)

HAST combines SAST and DAST methodologies to discover and fix application security vulnerabilities. Although this approach requires more time and budget, it is optimal for designing secure applications.

Conclusion

Most security incidents result from unfixed security errors being exploited by today’s complex IT threat environment. Your development team should be using a combination of open and closed box testing to protect applications and customers from cyberthreats.

Automating this security testing saves time and produces more accurate results. Learn more about how CircleCI DevSecOps tooling integrates automatic testing into your CI/CD pipeline.

Which of the following application tests analyzes an applications source code for vulnerabilities?

Which of the following interfaces developed by Microsoft is a set of interfaces that enable applications to access data stored in a database management system DBMS?

Which of the following refers to the flow a user is expected to follow in an application to accomplish a goal?

Which of the following cross site scripting vulnerabilities types relies on social engineering?