Technology evolution not only has it’s advantages, but also brings it’s challenges as well. In the current internet era, application security is of paramount concern. Static Application Security Testing (SAST) helps to address the security concerns during application development lifecycle. This articles discusses the various aspects of SAST.
What is Static Application Security Testing (SAST)
Static Application Security is a testing methodology with focus on application security. In SAST the source code is scanned to find security vulnerabilities. The important point to consider is SAST does not require code to be running. SAST analyzes the source code, binary for code pattern, rules which might result in software vulnerabilities.
Why SAST
As the code base size increases manual code review, for security, becomes challenging. With the help of SAST tools review process could be automated. SAST analysis ensure 100% code coverage, it’s faster and efficient compared to manual code reviews. SAST helps to identify application security vulnerabilities and mitigate security risk, before application is made available for end user.
Advantages of SAST
- Early Feedback – SAST does not require running code. The test can be performed in the early stage of SDLC resulting early feedback for developers. Early feedback also means less cost involved in fixes and risk mitigation. Many of the SAST tools can be integrated into developers IDE. This helps to get feedback as development team proceeds with the code implementation. SAST tools could be integrated into CI/CD pipeline. This ensures security check is performed for any code changes (big or small).
- Developer centric – Since the analysis is performed on the source code, the output pin points the source code location for vulnerability. This makes it easy for development team to analyze the fix the issue.
- Automates the review process – SAST automates the review process. Also the SAST tools has built in rules which are based on industry standards and widely used practices. This establishes a common pattern across the team resulting discipline among developers and robust code quality.
Considerations to be made
- Language Dependency – SAST is performed on source code. This makes SAST tools language dependent. Availability of SAST tool for given language is a must.
- False Positive – SAST does not require application to be running. Many of the time unavailability of run time context results in false positive results. Any recommendations provided by tools should be analyzed in the context of application being analyzed.
- Vulnerabilities coverage – SAST does not consider application run time behavior example – application run time vulnerabilities, application configuration. Other supporting tools (example DAST) are requires to cover completed landscape.
Steps to implement SAST
- Identify right tool – SAST tools are language dependent. Analyze and identify the tool which support the language being used in application development. During the identification another important aspect to consider is how it fits into your eco system. For example –
- Can the tools be plugged into developers IDE so that developer gets real time feedback while writing code
- Can the tools be integrated with CI pipeline so that code is analyzed as soon as any new code is pushed.
- Customize the tools – Fine tune the identified tool to meet organizational goal. This may include –
- Modify built in rules to avoid false positive
- Add new rules which are specific to given organization.
- On board application – Define a process so that all the applications are onboarded and scanned using SAST tool.
- Analyze the result to implement feedback- Process should be established to not only scan the application but to analyze and act on the findings as well. During the initial implementation of SAST for any given application it scan and result analysis becomes an iterative process. The analysis result should be analyzed by development team to identify common pattern, false positive etc. If required customize the tools to re-adjust the rules based on findings.
Example of SAST Tools –
Final word
Irrespective of size of application it’s recommended to have SAST as part of software development eco system. It helps to achieve one of the major Non-functional requirement security.
