Skip to content

security-testing.md

Latest commit

 

History

History
19 lines (13 loc) · 1.45 KB

security-testing.md

File metadata and controls

19 lines (13 loc) · 1.45 KB

Security testing of applications

90% of security incidents result from attackers exploiting known software bugs. If you can eliminate bugs in the developement phase of software, it could reduce information security risks facing many organizations. The following techniques are most commonly used for security testing of applications.

Static Application Security Testing(SAST)

It checks if coding is in conformance with the guidelines and standards. SAST does not find runtime errors. SAST can be easily automated and integrated in project's workflow.

Dynamic Application Security Testing(DAST)

It is also known as blackbox testing. Used for finding vulnerabilities in web applications. DAST also allows you to identify flaws in authentication and configuration issues. DAST does not flag coding errors.

Hybrid (SAST and DAST)

Often SAST and DAST are used in tandem to improve performance.

Interactive application security testing(IAST)

SAST and DAST are older technologies but they can not handle modern web and mobile applications wherein extensive AJAX and other interactive technologies are used.

Run-time Application Security Protection (RASP)

RASP works inside the application and is more of a security tool. It is plugged into application and controls application execution. RASP lets the application to run continuous security checks on itself and response to live attacks by terminating attacker's session and alerting defender to the attack.