In today’s technological world, security has taken center stage and has had a significant impact on the way companies developed their applications, due to the rise and evolution in the cyber-attack landscape. It is more important now than ever to identify and mitigate vulnerabilities during the Software Development Lifecycle (SDLC). Fortunately, a number of security testing strategies have emerged to mitigate the impact that vulnerable applications may have on the end users and on the organization, techniques like Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST), Interactive Application Security Testing (IAST), and Runtime Application Self-Protection (RASP) are at the center stage when it comes to secure software development methodologies and in this article, we will dive into how these techniques provide tools to strengthen the application security through and after the development has been completed.
Understanding DAST, SAST, IAST, and RASP
To understand how these tools can enhance the security of the application, first let us look at how each tool contributes to making the Software Developing Lifecycle more robust.
DAST (Dynamic Application Security Testing): It is also known as black-box testing, which evaluates the security of an application while this one is running. It simulates a real attack with the goal of identifying any vulnerabilities, achieving this by interacting with the application's user interface. It provides an outside scan, focusing on the exposed entry points and APIs. It is more commonly used for testing web applications and it’s very effective at identifying security flaws like injection attacks, cross-site scripting, and other security issues including vulnerabilities found in the OWASP 10; and it can be integrated very early into the software development lifecycle and its focus is to help organizations to reduce and protect against the risk that application vulnerabilities could cause[1] .
SAST (Static Application Security Testing): Security testing is not about speed or performance rather it is about finding vulnerabilities [2] and SAST helps find these vulnerabilities by analyzing the application's source code without executing it. It looks for security vulnerabilities, coding errors, and flaws in the code design. By using SAST, the developer team can identify issues like insecure coding practices and input validation problems. And it is remarkably effective at identifying issues in the code at very early stages of the development, it also encourages secure coding practices, which helps improve overall software quality. It is also known as a white box testing technique.
IAST (Interactive Application Security Testing): IAST combines elements of DAST and SAST and uses an “agent-like” approach meaning agents and sensors are run to continually analyze the application workings during automated testing, manual testing, or a mix of the two [3] This provides real-time vulnerability detection and analysis. Because it evaluates the application while it is running It can observe how inputs are processed to check for any vulnerabilities. It checks the application during runtime, monitoring code execution, data flow, and interactions with external components. This provides information in real time from inside the application allowing for a more accurate assessment and it allows developers to fix any issues in a brief period of time. Because this method requires integrating a testing agent or sensors it may impact performance and require additional development effort.
RASP (Runtime Application Self-Protection): This method secures the application from inside; meaning that it is integrated into the application by the form of a library or agent inside the application's runtime environment, RASP monitors the application's behavior and can detect and prevent attacks in real-time. Compared to the other methods previously discussed it is more concerned about securing the application than in finding vulnerabilities or issues in the code. And it is used after the application has been released and once it identifies any attacks it raises an alarm, tries to mitigate the attack, and alerts the team so they can take necessary action. RASP aims to fill the gap left by application security testing and network perimeter controls. [4]
Pro & Cons
When it comes to what method to implement in the development process all of these are good options and in some cases when money is not an issue, all of them can be put in place, but because this is not always a viable option, so is up to the stakeholders to decide what method or combination of methods best suit the needs of the project taking in consideration the scope, budget and goal.
Conclusion
There is an old proverb of an unknown author that goes as follows:
For want of a nail the shoe was lost
For want of a shoe the horse was lost.
For want of a horse the rider was lost.
For want of a rider the message was lost.
For want of a message the battle was lost.
For want of a battle the kingdom was lost.
And all for the want of a horseshoe nail.
-Unknown Author
This is similar as it relates to security within the software development cycle, where are single vulnerability can greatly impact the security of the application and by extension the company, its image, and stakeholders.
When it comes to software development, taking security action as early as the development starts can make the difference between an application that suffered a massive data breach because of a vulnerability that was never remediated, from an application that manages to keep all its user’s data safe due to a security-focused approach to software development.
Author
Jacobo Arzaga Martinez
Jr. Security Engineering
References