Securing web applications with SAST, DAST, and IAST
Introduction
If you have recently started working with web security, you have probably come across terms like AST, SAST, DAST, and IAST. They are part of the technical vocabulary used by cybersecurity professionals. Although the acronyms may look complicated at first, most of them come from English terms that describe how different tools test the security of web applications.
In this article, I’ll help you understand which type of tool makes more sense for each situation, and how these tools can help keep your web application safer from data leaks and attackers.
AST
The first thing to understand is what AST means: Application Security Testing. It refers to tools that look for security flaws so you can fix them before your business is exposed on the internet. Within this category, we can separate tools based on how they operate:
- Static AST;
- Dynamic AST;
- Interactive AST.
SAST
Static Application Security Testing is essentially source code analysis. It scans the codebase looking for patterns that may introduce vulnerabilities. Its behavior is similar to a white-box pentest, where internal information is available so the tester can find as many vulnerabilities as possible.
Advantages:
- It does not require a compiled application.
- It points directly to the code that causes the issue.
- It allows fixes during development, which is essential for DevSecOps-based delivery pipelines.
Disadvantages:
- It can generate many false positives.
- It does not detect vulnerabilities or errors that only appear at runtime.
- It does not identify environment configuration issues.
DAST
Unlike SAST, Dynamic Application Security Testing is used against compiled and running applications. In this case, the tool looks for vulnerabilities as if it were a client using the final application, sending automated payloads through forms and collecting information from the front end. With this kind of tool, we simulate a black-box pentest, where there is no prior knowledge of the infrastructure behind the application.
Advantages:
- It does not require source code access.
- It detects runtime vulnerabilities.
- It finds issues related to environment configuration.
- It usually produces fewer false positives.
- It simulates how an attacker sees the application.
Disadvantages:
- It requires a test environment with the application running, which increases cost.
- It depends on the development team to trace the root cause of the issue.
IAST
If a company needs to fix vulnerabilities during development and also have visibility into vulnerabilities in the final running application, it would traditionally need both SAST and DAST. That is why Interactive Application Security Testing tools were created. These tools combine aspects of the two previous categories: source code analysis and scanning of running applications. This gives stronger security coverage while taking advantage of both Dynamic AST and Static AST.
Which tools should I use?
As much as I would like to, it would be impossible to list every security solution categorized as AST here. Fortunately, Gartner evaluates widely used tools in the IT market and publishes reviews. You can check their AST ranking at this link.
Every year, Gartner also publishes a “Magic Quadrant” with major vendors in the market, organized according to four categories:
- Challengers: companies that are behind the leaders, even though they are present in a significant part of the market.
- Leaders: companies that lead the market.
- Niche players: companies focused on a specific niche.
- Visionaries: companies that stand out for innovation.
In April of that year, Gartner published the quadrant for companies with AST solutions, which you can see below:
That’s it for today. I hope this article helped you better understand this alphabet soup from the world of security and secure development.