Static Application Security Testing (SAST)

• OWASP SonarQube for Code Scanning

Dynamic Application Security Testing (DAST)

• Fortify Webinspect for Dynamic Application Security Testing (DAST)
• AppScan on Cloud

Runtime application self-protection (RASP)

• Twistkock – Understanding and Implementing Security aspect of Docker()
• Notary – Understanding and Implementing Security aspect of Kubernetes()
• NewRelic – Understanding and Implementing Security aspect of Java Virtual Machine
• AWS Security service – Understanding and Implementing Security aspect of AWS cloud.
• Chef InSpec – For Scanning your applications and infrastructure
• ELK – For Log analysis related to Security Threat.
• HashiCorp Vault – For security tool for certificates, API keys, or passwords
• Fortify Application Defender – For Runtime Application Security Testing (RAST)

Comparison of SAST, DAST, and RASP in DevSecOps

Feature	SAST (Static Application Security Testing)	DAST (Dynamic Application Security Testing)	RASP (Runtime Application Self-Protection)
Definition	Analyzes source code, bytecode, or binary for vulnerabilities without executing the application.	Examines the application in a running state by simulating attacks to find vulnerabilities.	Protects the application during runtime by monitoring and preventing attacks within the app itself.
When Applied	Early in the SDLC during the coding phase.	After deployment, during testing or staging environments.	During runtime in production environments.
Type of Testing	White-box testing (access to source code).	Black-box testing (no access to source code).	Real-time protection in a live environment.
Vulnerability Detection	Identifies coding flaws, hardcoded secrets, and potential vulnerabilities like SQL injection or XSS.	Detects vulnerabilities like XSS, CSRF, and SQL injection by interacting with the application.	Identifies and mitigates attacks like SQL injection, XSS, and unauthorized access in real time.
Primary Focus	Code-level vulnerabilities before deployment.	Application behavior under simulated attacks.	Mitigating threats during runtime.
Advantages	– Detects issues early in development.- Reduces costs of fixing vulnerabilities later.- Comprehensive coverage of code.	– No access to source code required.- Tests real-world scenarios.- Finds vulnerabilities missed by SAST.	– Real-time attack detection and prevention.- No modifications to the code needed.- Works with third-party libraries.
Limitations	– False positives can be high.- Cannot detect runtime vulnerabilities.- Limited effectiveness for compiled code.	– Requires a deployed application.- Limited in detecting deep code-level issues.- Higher false negatives.	– Performance overhead.- Complex integration.- May not provide full coverage for all vulnerabilities.
Use Cases	– Reviewing source code for vulnerabilities before deployment.- Ensuring compliance with secure coding practices.	– Penetration testing.- Validating application security in staging environments.- Identifying vulnerabilities in live applications.	– Protecting live applications from real-time attacks.- Complementing WAF and other security tools.

---

Popular Tools for SAST, DAST, and RASP

1. SAST Tools

Tool	Features	Languages Supported
SonarQube	– Detects vulnerabilities, code smells, and bugs.- Integrates with CI/CD pipelines.	Java, C#, JavaScript, Python, etc.
Checkmarx	– Offers deep code analysis.- Highly customizable for specific projects.	Multiple languages.
Fortify Static Code Analyzer	– Enterprise-grade tool for static analysis.- Provides detailed vulnerability insights.	Over 25 languages.
Veracode Static Analysis	– Cloud-based SAST.- Easy integration with CI/CD pipelines.	Java, .NET, Python, etc.
Codacy	– Focuses on code quality and security issues.- Integrates with GitHub, GitLab, etc.	Multiple languages.

---

2. DAST Tools

Tool	Features	Use Cases
OWASP ZAP	– Open-source DAST tool.- Automated vulnerability scanning.- Active and passive scanning.	Penetration testing, security assessments.
Burp Suite	– Advanced manual and automated DAST capabilities.- Highly extensible with plugins.	Web application security testing.
Acunetix	– Automated web application scanner.- Detects over 7,000 vulnerabilities.	Comprehensive web vulnerability scanning.
Netsparker	– Accurate DAST with minimal false positives.- Supports automation in CI/CD pipelines.	Scanning for web vulnerabilities like XSS and SQL injection.
AppScan	– Enterprise-grade DAST.- Integration with DevSecOps workflows.- Focus on OWASP Top 10.	Validating security in staging environments.

---

3. RASP Tools

Tool	Features	Use Cases
Contrast Security	– Real-time vulnerability detection.- Protection against OWASP Top 10 vulnerabilities.- Lightweight and efficient.	Runtime attack prevention in production.
Imperva RASP	– Protects web applications by neutralizing attacks at runtime.- Seamless integration without code changes.	Enhancing WAF and protecting APIs.
Waratek	– Java-focused RASP solution.- Provides zero-day protection.- Works without code modification.	Runtime security for Java applications.
Signal Sciences (Acquired by Fastly)	– Combines RASP with advanced threat intelligence.- Integrates with DevSecOps pipelines.	Protecting microservices and APIs.
Runtime Application Self Protection (CA Veracode)	– Comprehensive runtime protection.- Focuses on application-layer security.	Real-time protection in live environments.

---

How to Integrate These Tools in DevSecOps

1. Integrating SAST:
   • Use SAST tools early in the development lifecycle during code writing and reviews.
   • Automate SAST in CI/CD pipelines to prevent introducing vulnerabilities.
   • Example: Run SonarQube as part of Jenkins builds.
2. Integrating DAST:
   • Conduct regular scans in staging and pre-production environments.
   • Use DAST tools during integration testing or user acceptance testing (UAT).
   • Example: Automate OWASP ZAP scans in CI/CD pipelines.
3. Integrating RASP:
   • Deploy RASP tools in production environments to monitor and mitigate runtime threats.
   • Complement RASP with Web Application Firewalls (WAFs) for comprehensive protection.
   • Example: Use Contrast Security alongside a WAF for live protection.

---

Conclusion

• SAST: Best for identifying code vulnerabilities early in the SDLC.
• DAST: Best for finding vulnerabilities in running applications by simulating attacks.
• RASP: Best for real-time protection of live applications.

By integrating SAST, DAST, and RASP tools into a DevSecOps workflow, organizations can address vulnerabilities across all phases of development, testing, and production. These tools complement each other to provide robust application security.