Application security testing is an important component of any organization’s cybersecurity strategy. In 2019 alone, over 22,000 new vulnerabilities were discovered and publicly reported. When vulnerabilities exist within an organization’s applications, they potentially allow an attacker to access sensitive data or the organization’s internal network.

The Types of Application Security Testing

Performing application security testing should be a core component of an organization’s application development process. Various types of application security testing (AST) solutions are available:

  • Static Application Security Testing (SAST): SAST performs a “white box” assessment of an application’s source code. This means that the AST tool scans the code of an application for programming patterns that could potentially introduce exploitable vulnerabilities.
  • Dynamic Application Security Testing (DAST): DAST performs a “black box” assessment of an application. Such an assessment involves running the application and sending malicious or malformed input to it to cause errors that could indicate potential bugs or exploitable vulnerabilities.
  • Interactive Application Security Testing (IAST): IAST deploys agents and sensors within an application, taking advantage of the additional visibility that it provides. IAST monitors the execution flow of the application, identifying potential issues as the application reaches them.

Selecting an Application Security Testing Strategy

SAST, DAST, and IAST each have their own pros and cons. When selecting a strategy and toolset for AST, the following considerations should be kept in mind:

  • Vulnerability Detections: The most important factor to consider when selecting an AST solution is how capable it is of detecting potentially exploitable vulnerabilities within an application. In general, IAST’s greater insight into an application and its execution flow provides the highest rate of vulnerability detections.
  • False Positive Detections: False positive detections decrease the usability of an AST tool’s results since they waste a security team’s time and resources addressing potential issues that pose no threat to the application. SAST, while it has a relatively high detection rate, also produces a high quantity of false positives.
  • Test Coverage: 70% of applications have an open-source dependency that contains an exploitable vulnerability. AST based solely on source code review, like that provided by SAST tools, overlooks a significant portion of the attack surface.
  • Issue Identification: Beyond identifying that a vulnerability exists within an application, it is also useful if an AST tool is capable of pointing to the cause of the issue within the application’s code. SAST and IAST solutions provide this capability due to their insight into the application’s code.
  • Language and Platform Dependence: Some AST tools are designed to only support applications written in certain programming languages or for certain platforms. When selecting an AST solution, it is important to ensure that it is capable of working on the platforms and languages that an application is using.

How MorganFranklin Can Help

Effective application security testing is essential to protecting an organization against cyberattacks.  Web applications are a common target of cybercriminals because they are easily accessible, prone to containing unpatched vulnerabilities, and provide access to sensitive data or an organization’s network.

SAST, DAST, and IAST all offer different pros and cons for application security testing.  MorganFranklin Analysts can help with selecting the right tool for you organization’s testing program and integrating it into your development workflow to provide strong application security with minimal impact on development timelines.