Static Application Security Testing (SAST)

What Is Static Application Security Testing?

Static Application Security Testing (SAST) is a type of software security testing that is performed by analyzing the source code of an application. It is a form of white box testing, meaning that the tester has access to the source code and can analyze it for potential security vulnerabilities. SAST can identify a wide range of vulnerabilities, including SQL injection, cross-site scripting, and buffer overflows.

Usage and Examples

SAST is used by organizations of all sizes to identify potential security vulnerabilities in their applications. Examples of SAST tools include Checkmarx, Veracode, and SonarQube.

For a hands-on assessment that goes beyond static analysis, Evolve Security's Application Penetration Testing service combines automated and manual testing to uncover vulnerabilities in web and mobile applications.

Static Application Security Testing

What Is Static Application Security Testing?

Description

Usage and Examples

Access control

Application Penetration Testing

Attack Surface

Botnet

Business Email Compromise (BEC)

BYOD

CIS Controls

CIS RAM

Cloud computing

Cloud Security

COBIT

Cryptocurrency

Cyber Maturity Model Certification (CMMC)

Cyber Threat Intelligence

Darknet

Data Breach

Data Loss Prevention

DDoS Attack

Declaration of Conformity

DMZ

Encryption

Endpoint

Endpoint Detection and Response

Ethical Hacking Tools

Firewall

FISMA

Gap analysis

GDPR

Hacker

HIPAA

Hypervisor (VMM)

Identification

Identity Theft

Incident Response

Infrastructure-as-a-Service (IaaS)

Initial Access Brokers

Internal Penetration Testing

Intrusion detection system (IDS)

Intrusion Prevention System (IPS)

ISO 27001

Keyboard logger

Macro virus

Malicious Apps

Malware

Managed Detection and Response (MDR)

MTTD and MTTR

Multi-Factor Authentication (MFA)

Network Firewall

Network Penetration Testing

Network Security

Network Security Assessment

NIST Cybersecurity Framework

Password

Password Cracking

PCI DSS

Penetration Testing

Phishing

Platform-as-a-Service (PaaS)

Privilege Escalation

Proxy server

Ransomware

Ransomware-as-a-Service

Red Team Vs. Blue Team

Risk assessment

Secure Shell (SSH)

Security Control

Security Information and Event management (SIEM)

Security Operations

Security Operations Center (SOC)

Security Orchestration Platform

Security Orchestration Tools

Security Perimeter

Security Policy

Session Hijacking

Shadow IT

Social Engineering