In this lesson,
we will learn about pre-deployment testing.
Pre-deployment testing is used to evaluate software
for security vulnerabilities, functional issues,
and performance concerns
before the software is released
into a live environment.
This includes Static Application Security Testing, or SAST,
Dynamic Application Security Testing, or DAST,
and Interactive Application Security Testing, or IAST.
To better visualize the SAST, DAST,
and IAST aspects of pre-deployment testing,
let's think about preparing your car
for a long road trip.
Static Application Security Testing, or SAST,
is like checking the car's engine
before starting the trip.
So before hitting the road,
you inspect the engine
to ensure everything is in good shape.
This basic check is done
to catch any developing problems
such as oil leaks,
which could lead to a breakdown.
Similarly, Static Application Security Testing
inspects developer code while it's static,
identifying vulnerabilities early
to avoid issues when the application runs.
Next, Dynamic Application Security Testing, or DAST,
is like taking the car
for a pre-road trip test drive.
During the drive, you observe how the car performs,
paying attention to how it handles
and responds in real conditions.
Similarly, DAST tests an application while it's running,
identifying vulnerabilities that only appear
in a runtime environment,
much like checking the car's performance in motion.
Finally, Interactive Application Security Testing, or IAST,
is like having a realtime diagnostic system
installed in your car.
Your diagnostic system continuously monitors
the car's performance,
providing realtime alerts for issues
like engine trouble or low tire pressure.
In the same way, IAST provides ongoing feedback
during application testing,
monitoring both the code and system behavior
to detect vulnerabilities as they arise in real time.
So now let's learn even more
about Static Application Security Testing,
Dynamic Application Security Testing,
and Interactive Application Security Testing.
First, we have Static Application Security Testing, or SAST.
SAST is used to analyze a software application's source code
or binaries for vulnerabilities
without executing the software.
The primary objective of SAST
is to identify potential security weaknesses
such as coding flaws early in the development process.
The detection of weaknesses early
in the development process
allows issues to be resolved
before the software is deployed.
Overall, Static Application Security Testing
can be conducted through automated tools
and manual code reviews,
both of which are integral to securing software.
Automated SAST tools such as check marks, Veracode,
and Fortify automatically scan code bases
for common vulnerabilities like SQL injection,
Cross-site Scripting, buffer overflows,
and improper error handling.
For example, if a developer uses
the insecure C language function, strcpy,
an automated SAST tool can flag it
and recommend a more secure alternative like strncpy,
because the strcpy function
doesn't check the size of the input,
which can lead to potential buffer overflows.
Next, manual code review is another key component
of Static Application Security Testing.
In a manual code review,
developers carefully examine someone else's code
for vulnerabilities that automated tools might miss.
So while an automated SAST tool
might flag obvious issues,
manual code reviews can catch more complex problems
such as logical flaws,
improper error handling in edge cases,
or insecure use of cryptographic libraries.
During a manual review,
a reviewer might spot
a non-secure C language function like sprintf,
which can also cause buffer overflows.
Then the manual reviewer might suggest
using the snprintf function instead
because it will not cause buffer overflows.
But while SAST is powerful,
it also has its challenges.
One challenge is the occurrence of false positives.
A false positive occurs
when a tool flags potential issues
that aren't actual vulnerabilities.
This can frustrate developers
and take a lot of time to investigate.
Additionally, Static Application Security Testing,
whether manual or automated,
can miss vulnerabilities that only manifest
when the application is running,
such as issues related to the system's environment
or dynamic logic flows.
Second, we have Dynamic Application Security Testing,
or DAST.
DAST assesses the security of a running application
by simulating attacks in real time
to identify potential vulnerabilities.
The main objective of Dynamic Application Security Testing
is to find flaws that occur
while the application is operating.
For example, injection flaws like SQL injection
or Cross-site Scripting can be identified
by inserting a harmful code
into input fields of a web application.
Similarly, DAST can help uncover weaknesses
in authentication processes
where an attacker might be able
to bypass login mechanisms
due to improper validation or session management.
There are a variety of tools available
to perform Dynamic Application Security Testing,
including open source solutions
like the Zed Attack Proxy, or ZAP,
and commercial ones like Burp Suite.
Another notable tool is the Peach Fuzzer,
which specializes in fuzzing.
Fuzzing is a technique where a large number
of random or unexpected inputs
are sent to the application
to uncover crashes and security flaws.
For example, if an application processes uploaded files,
the Peach Fuzzer can send a range of malformed
or unexpected file types and data
to observe how the system handles
and processes each of these inputs.
If the application crashes or behaves erratically,
it may indicate a vulnerability
that could be exploited by an attacker.
So Dynamic Application Security Testing is powerful,
but it also has some weaknesses.
Since DAST only tests the application from the outside,
it might miss internal vulnerabilities
or logic flows that can only be seen in the source code.
Also, like Static Application Security Testing,
Dynamic Application Security Testing
can also generate false positives
by flagging potential issues
that are not actually exploitable,
and DAST can be less effective
against complex vulnerabilities
that require a deeper understanding
of the application's business logic.
Third and finally,
we have Interactive Application Security Testing, or IAST.
IAST is a hybrid approach
that combines the strengths
of both Static Application Security Testing
and Dynamic Application Security Testing.
The primary objective of IAST,
or Interactive Application Security Testing,
is to offer realtime feedback on vulnerabilities
while an application is running,
unlike Static Application Security Testing,
which only examines static code,
or Dynamic Application Security Testing,
which interacts with running applications.
From an external viewpoint,
Interactive Application Security Testing
works by integrating directly with the application
as it operates.
This enables IAST to analyze both the code
and runtime behaviors simultaneously,
providing a more comprehensive assessment
of security issues.
For example, in the development
of a new e-commerce platform,
developers could use an IAST tool
while running their functional tests.
As they interact with different parts
of the application
such as the payment gateway
or user registration,
the interactive application security tool
could analyze the application's behavior
and highlight security risks in real time.
The IAST tool might identify vulnerabilities
like improper input validation,
where the application doesn't properly check user inputs,
or insecure data storage,
where sensitive information
such as passwords are not encrypted correctly.
Because the feedback is immediate,
developers can address these issues on the spot,
making it easier to fix problems
before the application goes live.
There are several tools available
for Interactive Application Security Testing,
including contrast security and Veracode.
These tools integrate seamlessly
into the development environment,
providing developers with actionable insights
as they test and build the application.
This real time feedback reduces the time it takes
to discover and fix vulnerabilities
compared to traditional security testing approaches.
However, Interactive Application Security Testing
is not without its weaknesses.
Since it relies on the application being actively tested,
it might not uncover all vulnerabilities
unless the application is thoroughly exercised
during the testing.
This means that any parts of the application
that are not tested go unchecked.
Additionally, IAST tools may have performance impacts
on the running application itself,
slowing down functional tests
or affecting the overall development workflow.
So remember, pre-deployment testing
is used to identify security vulnerabilities,
functional issues, and performance concerns
before software is released into a live environment.
This testing includes techniques
like Static Application Security Testing, or SAST,
Dynamic Application Security Testing, or DAST,
and Interactive Application Security Testing, or IAST.
Static Application Security Testing
analyzes the source code without running the application,
Dynamic Application Security Testing
evaluates security during runtime,
and Interactive Application Security Testing
combines both approaches for realtime feedback.
Each method has its own strengths and weaknesses.
Using a combination of SAST, DAST, and IAST
is the best approach
for comprehensive pre-deployment testing.