Application Security Testing

Application Security Testing (AST) includes all tasks that introduce a secure software development life cycle to development teams. Its final goal is to improve security practices and, through that, to find, fix and preferably prevent security issues within applications. It encompasses the whole application life cycle from requirements analysis, design, implementation, verification as well as maintenance.

Security testing techniques scour for vulnerabilities or security holes in applications. These vulnerabilities leave applications open to exploitation. Ideally, security testing is implemented throughout the entire Software Development Life Cycle (SDLC) so that vulnerabilities may be addressed in a timely and thorough manner.

There are many kinds of automated tools for identifying vulnerabilities in applications. Common tool categories used for identifying application vulnerabilities include:

• Static Application Security Testing (SAST); analyzes source code for security vulnerabilities during an application's development. Compared to DAST, SAST can be utilized even before the application is in an executable state. As SAST has access to the full source-code it is a white-box approach. This can yield more detailed results but can result in many false-positives that need to be manually verified.
• Dynamic Application Security Testing (DAST); automatically detects vulnerabilities by crawling and analyzing web sites. This black-box scanning based method is highly scalable, easily integrated and quick. DAST tools are well suited for dealing with low-level attacks such as injection flaws but are not well suited to detect high-level flaws, e.g., logic or business-logic flaws.
• Interactive Application Security Testing (IAST); assesses applications from within using software instrumentation. This gray-box based approach combines the strengths of both SAST and DAST methods as well as providing access to code, HTTP traffic, library information, backend connections and configuration information. Some IAST products require the application to be attacked, while others can be used during normal quality assurance testing.
• Mobile Application Security Testing (MAST); fundamentally Mobile AST solutions test applications in 3 main ways: SAST: These solutions statically analyze the source, binary or bytecode of an application to identify vulnerabilities. Behavioral testing: Mobile AST solutions use behavioral analysis to observe the behavior of the app during runtime and identify actions that could be exploited by an attacker. DAST: These solutions also use dynamic analysis to test the app in its runtime state. DAST simulates attacks against an application and analyzes the application's reactions, determining whether it is vulnerable.

iSOC24 carries the Rapid7 solutions as well as the Synack Crowd Sourced Web Application testing services in its extensive portfolio.

If you would like to learn more about the Rapid7 and Synack propositions and how these can best fit in your situation please contact one of the specialists of iSOC24.