Introduction to Application Security Testing
Application Security testing is an integral part of SDLC (Software development lifecycle) and used to discover the weaknesses, risks or threats in software applications and help to detect vulnerabilities hidden in applications which can be exploited. The main objective of application security testing is to find all potential vulnerabilities of an application and fix them.
The security testing is required to be done in the initial stages of the software development lifecycle because if we perform security testing later post software execution phase it will cost more to fix gaps. Testing can be manually or in automated manner. In Manual testing various methods are used such as white box testing, black box testing and so on.
Today we look more in detail about some manual testing techniques – SAST, DAST and IAST. Their features, functionalities and use cases and will understand the difference between each of these testing techniques.
DAST (Dynamic Application Security Testing)
DAST or Dynamic Application security testing is a security tool which is used for scanning any web application to discover security vulnerabilities. This tool is used to detect vulnerabilities inside a web application program which is being deployed or in production. These tools send alerts to the security team for taking remediation actions. It can be integrated early into the software development lifecycle and its focus is to help organizations to reduce and protect against risks caused by application vulnerabilities.
DAST uses a black box technology and conducts vulnerability assessment from outside and doesn’t have access to application source code. DAST is used during testing and SQ face of SDLC cycle.
Pros and Cons of DAST
PROS
- Independent of underlying platform and technology
- Good support for manual penetration
CONS
- Insufficient coverage
- No information on location issue in code base
- Output is static report
- Can be slow
SAST (Static Application Security Testing)
SAST or Static Application security testing in this source code is tested way before application is live and deployed in production environment. It helps to detect vulnerabilities in applications before everyone else comes to know about them. SAST uses a testing methodology of analysing a source code to detect any traces of vulnerabilities which could provide a backdoor for hackers. It usually analyses and scans applications before compilation of code.
It is a white box testing technique where source code is visible to the developer and it is an approach where testers test the inner structure of a software before it integrates with the external systems.
Pros and Cons of SAST
PROS
- Multiple language support
- Easy to understand
CONS
- Poor accuracy (35% false +ve reported)
- No visibility of code execution flow
- Output is static report
- Requires customization and tuning
- Can be slow
- Not for systems in production stage
IAST (Interactive Application Security Testing)
IAST or Interactive application security testing tool was designed to test both web and mobile applications to detect and report issues even when application is running. Before someone else can use IAST they should have good knowledge of DAST and SAST techniques. It uses a grey box technique and it testing occurs in real time while application is running in stagging environment. It also checks source code at post build stage.
IAST agents are usually deployed on application servers and agent returns a line number of the issue from source code. The IAST agents can be deployed on application servers and during functional testing done by QA tester. Agents will study the pattern that a data transfer inside the application follows irrespective of it is vulnerable or not.
Pros and Cons of IAST
PROS
- Accurate, can detect 100% of OWASP benchmark with no False+ves
- Flexible for use
- No need for scan or attack application
- Results are in real time
- Continuous detection and DevOps friendly
- Truly Plug & play no configuration or tuning requirements
CONS
- Requires specific language support
Comparison Table: DAST vs SAST vs IAST
Below table summarizes the differences between the three:
FUNCTION | DAST | SAST | IAST |
| Testing Technique | This is a black box testing where there is no access to internal framework that comprises of application, source code and design | This is a white box testing where access to source code, application and design is available within internal framework | This is a grey box testing and used for identification of vulnerabilities in real time |
| Testing Methodology | The complete application is tested from the inside out. It is also known as developer approach | The complete application is testing from outside in. it is often called as hacker testing | This support the accuracy of SAST through use of the run time analysis of results generated from SAST |
| Deployment requirements | It requires deployment on an application server and not require to access source code | It does not require deployment and usually analyses source code directly without execution of an application | This requires deployment of IAST agent on application servers |
| Deployment scenario in SDLC | It is used only after code is compiled | It analyses source code and used very early in SDLC | Performed during Test and QA stage of SDLC |
| Costing | This tool is expensive as vulnerabilities are detected at a later stage of SDLC at times in the end. | It is not very expensive because vulnerabilities are detected very early in SDLC and remediated before code is in motion | Highly priced |
| Scanning techniques | It only scan applications by using dynamic analysis to detect run time vulnerabilities | It scans only static code and can’t discover run time vulnerabilities | Supports real time scanning |
| Applications supported | It scans only web applications | It supports all kind of applications | Supports web and mobile applications |
| Process type | DAST is a validation process and used to find and fix defects | SAST is a verification process and used to find defects | It is both validation and verification and combine the best of both SAST and DAST |
 | |||
Download the comparison table: DAST vs SAST vs IAST
Conclusion
SAST, DAST and IAST are good security tools that can complement each other provided the organization has enough financial budget to support them. Security experts advise to use more than one combination of tools in the environment to address the majority of vulnerabilities.
Continue Reading:
What is SAST (Static Application Security Testing) ?
What is Penetration Testing or Pen Test?
