Static Application Security Testing (SAST)

C.

Static application security testing (SAST) is conducted with knowledge of the system, including source code, and is done against offline systems.

Static Application Security Testing (SAST) is a type of application security testing that examines the source code of an application to identify security vulnerabilities. It is a type of white box testing that offers several benefits to testers:

C. Source code access: SAST provides testers with access to the source code of an application. This allows them to examine the code in detail and identify potential security vulnerabilities, such as SQL injection, cross-site scripting (XSS), and buffer overflow errors. By reviewing the source code, testers can also gain a better understanding of how the application works and identify areas where security controls can be strengthened.

A. Production system scanning: SAST tools can be used to scan production systems for vulnerabilities. This can help testers identify security issues in live applications and take corrective action to address them. By scanning production systems, testers can identify vulnerabilities that may have been introduced through changes in the code or configurations that were not identified during earlier testing phases.

B. Injection attempts: SAST tools can be used to test applications for injection vulnerabilities. This involves attempting to inject malicious code into an application to identify areas where the application is vulnerable to attack. By identifying injection vulnerabilities, testers can take steps to mitigate the risk of attacks and protect the application from malicious activity.

D. Live testing: SAST can also be used to perform live testing of applications. This involves monitoring the application in real-time to identify security vulnerabilities as they occur. By using SAST tools to perform live testing, testers can quickly identify security issues and take corrective action to prevent them from being exploited.

Overall, SAST provides testers with a powerful tool for identifying security vulnerabilities in applications. By examining the source code, scanning production systems, testing for injection vulnerabilities, and performing live testing, SAST tools can help testers identify and address security issues before they can be exploited by attackers.