DevOps is a quickly growing practice for many companies in almost every market. With the cyber attacks taking more precedence over the past decade, security has slowly crept forward in the SDLC to the point where we’re now hearing the term DevSecOps or SecDevOps in developer circles.
To keep things tidy and help developers manage additional security responsibilities, tools for static and dynamic application security testing (SAST and DAST) have made their way into the fray.
SAST and DAST are critical tools for successful DevSecOps. Each runs a set of automated tests, and both introduce security at the beginning of the software development lifecycle.
Static application security testing (SAST) can be used to check and your analyze source code to find possible vulnerabilities in your implementation. – and is also a type of white box testing. The test will run before your code is deployed, ensuring that developers are alerted to fixes during the development phase. SAST can help remediate situations where your code has a potentially dangerous attribute in a class or unsafe code that can lead to unintended code execution. It can analyze the control flow, the abstract syntax tree, how functions are invoked, and if there are any information leaks in order to detect weak points that may lead to unintended behaviors.
SAST will automatically generate a summary of fixes and unresolved vulnerabilities following every code commit, but before your code is merged to the target branch. Tools that allow SAST reports to sit within the developer’s work interface enable ease of remediation and streamline testing procedures within the development phase.
There are many well-known commercial products that are providing SAST. Most of them support multiple languages, and are integrated into the development lifecycle. The nature of SAST is very language specific. Since each language has its own syntax and features, SAST requires specific analyzers to target different languages, like Java, Node.js, and Ruby.
Our goal is to provide a DevOps tool where SAST is a part of the standard development process. This means that SAST is executed every time a new commit is pushed to a branch. The DevOps tool SAST complexity is totally transparent to users. We are able to automatically detect the programming language and to run the proper analizer.
SAST results can be consumed in the merge request, where only new vulnerabilities, introduced by the new code, are shown. SAST results are also part of the Security Dashboard, where Security Teams can check the security status. Our tool has the unique position to deeply integrate into the development lifecycle, with the ability to leverage CI/CD pipelines to perform the security tests. There is no need to connect the remote source code repository, or to use a different interface.
Interested in knowing more about the DevOps tool in question for SAST? Send us a mail at firstname.lastname@example.org