Home › Software Development Security
SAST vs DAST vs IAST vs SCA: Application Security Testing Explained
Software Development SecurityCISSPSecurity+CySA+
How do you find the security flaws in your own software before an attacker does? In this video, I'll walk through the four main methods of application security testing: static application security testing (SAST), dynamic application security testing (DAST), interactive application security testing (IAST) and software composition analysis (SCA). For each one, you'll see what it looks at, what it finds, what it misses, and where it runs, plus the 2017 Equifax breach that shows why a component inventory matters.
What you will learn
- Application security testing (AST) and the white box, gray box and black box views
- SAST: reading the code without running it, early in the integrated development environment (IDE), and its limits
- DAST: testing the running app from outside with scanners and fuzzing, and its limits
- IAST: an agent inside the running app during tests, and its limits
- SCA: component inventory, software bill of materials (SBOM), known Common Vulnerabilities and Exposures (CVE) entries, and the Equifax breach
- How the four methods compare and work together in a continuous integration and continuous delivery (CI/CD) pipeline
- Three tip ideas: clean scan ≠ secure app; IAST ≠ runtime application self-protection (RASP); finding ≠ fixed