Static Application Security Testing (SAST)

SAST analyzes source code or binaries for security vulnerabilities without executing the program. It is typically performed early in the development lifecycle and helps identify issues like SQL injection, cross-site scripting (XSS), and insecure coding practices.

Dynamic Application Security Testing (DAST)

DAST tests a running application to identify vulnerabilities in real-time. It simulates external attacks and is effective in detecting runtime issues such as authentication flaws, server misconfigurations, and insecure APIs.

Benefits of Automation

Tools Used

Common tools for SAST include:

  1. SonarQube

  2. Checkmarx

  3. Fortify

  4. CodeQL

Common tools for DAST include: OWASP ZAP

Integration Strategies in CI/CD Pipelines

Integrating SAST and DAST into CI/CD pipelines involves:

Sample Configurations

SAST with SonarQube in Jenkins

pipeline { 
  stages { 
    stage('Code Analysis') { 
      steps { 
        script { 
          sh 'sonar-scanner -Dsonar.projectKey=myapp -Dsonar.sources=src -Dsonar.host.url=http://localhost:9000' 
        } 
      } 
    } 
  } 
}

DAST with OWASP ZAP in GitHub Actions

  
    jobs: 
  zap_scan: 
    runs-on: ubuntu-latest 
    steps: 
      - name: ZAP Baseline Scan 
        uses: zaproxy/[email protected] 
        with: 
          target: 'http://localhost:8080' 
          fail_action: true

Best Practices