Common AppSec tooling and test approaches

There are several types of AppSec tooling and test approaches, as discussed earlier in this chapter. A few of the most common ones are SAST, SCA, DAST, fuzz testing, and penetration testing. This section will describe these types in more detail.

SAST

This section provides a brief overview of SAST.

What is it?

One of the foundational pillars of AppSec is SAST. From the early days of linters in the 1970s, which checked for coding style violations, static analysis has evolved into complex scanning techniques that are capable of identifying a wide array of issues in software.

These tools scan source code statically – that is, the target application isn’t running but rather the source code is scanned. SAST tools generally serve two main purposes: identifying weaknesses and vulnerabilities and checking for coding rule violations.

SAST tools use various techniques, such as pattern matching, data flow analysis, and taint...