Dynamic and Static Analysis

Dynamic application security testing (DAST) tools analyze applications in their dynamic running state during testing or operational phases. They simulate attacks against an application (typically web-enabled applications, services, and APls), analyze the application's reactions, and determine whether it is vulnerable.

DAST tools go one step further than SAST and spin up a copy of the production environment inside the Cl job to scan the resulting containers and executables. The dynamic aspect helps the system catch dependencies that are loaded at launch time, such as those that would not be caught by SAST. When the software is scanned during execution, even if only partial portions of the code are executed, a dynamic analysis is conducted. Hybrid, concolic, symbolic, and simulated execution methods are included as dynamic analysis techniques. While dynamic analysis is typically associated with binary analysis, interpreted languages can be executed to perform certain analysis.

Specialized Application Testing

Many applications provide specialized tools for penetration testing and analysis. When developers or business stakeholder constructs use cases, they| create specialized testing tools for their application. These testing tools and environments must include testing that is specifically designed to elicit the behaviors that may occur when secure coding best practices are not optimal, and a potential vulnerability could be exploited.

Dynamic Binary Analysis

Scanning a binary for weaknesses by executing it (usually in a sandboxed environment) can help an analyst quickly observe and determine anomalous behavior in an application. Dynamic binary analysis is useful whether or not access to an application's source code is available.

An application that has unit tests, functional test cases, and acceptance criteria should document how to perform tests to verify not only the functionality of the code, but evidentiary behavior if a vulnerability in the code was exploited. When a test fails, each test should be documented for its potential security impact on the software.

Dynamic Source Analysis

Some tools interpret source code for analysis or analyze source code while performing a dynamic analysis of an application.

Static Analysis

Static application security testing (SAST) tools analyze an application's source, bytecode, or binary code for security vulnerabilities, typically at the programming and/or testing software life cycle (SLC) phases.

Specifically, this technology involves techniques that look through the application in a commit and analyze its dependencies. If any dependencies contain issues or known security vulnerabilities, a commit will be marked as insecure and will not be allowed to proceed to deployment. This can also include finding hardcoded passwords/ secrets in code that should be removed. Static analysis enables an application to be assessed without executing it. Static analysis techniques use software source code, build processes, binaries, and metadata to perform testing.

Static binary analysis operates on a binary without utilizing the application's source code. Static binary analysis looks for programmatic weaknesses in executable code, often using the experience of a subject matter expert.

Static Source Analysis

Static source analysis scans software code for weaknesses. In some cases, static source analysis tools require the software to build in order to reveal the composition of data structures, control flow graphs, and dependencies with linked components. Once the analysis platform exposes the structure of these resources, it can analyze their usage directly in source code without executing the software.