Subscribe
Today, 85% of security attacks target software applications, according to SAP. Not surprisingly, an array of application security testing tools are available to help companies address security risks, and they vary in both approach and coverage. This guide to SAST and SCA discusses how these two types of application security solutions can help you address different risks.
The challenge of writing good software
In a world that runs on software, organizations face a challenge: Writing good software is hard. As software becomes increasingly complex, ensuring that it is reliable and secure becomes more difficult. Opportunities to make mistakes abound, whether for purchased software, proprietary software, or software delivered as a service—and particularly for open source software. The benefits of open source benefits are clear: faster time to market, greater opportunities to innovate, lower development costs, and access to a global community of developers. But organizations often overlook the security and risk management challenges related to open source use.
Weaknesses in proprietary code
Security weaknesses, such as those listed in the OWASP Top 10 and the 2019 CWE Top 25, are introduced into proprietary code by developers. Among the most well-known weaknesses are SQL injection, broken authentication and session management, and cross-site scripting. Static application security testing (SAST) can detect common types of weaknesses by examining the code itself, as developers are writing the code and at commit, build, and testing.
Vulnerabilities in open source components
Open source vulnerabilities, such as those listed in the National Vulnerability Database (NVD), are introduced through the use of open source components in a codebase. Open source is no more or less secure than commercial software, but organizations that lack visibility into the open source they use cannot effectively mitigate and remediate open source vulnerabilities. And the number of open source vulnerabilities is growing; the NVD reported more than 16,000 new open source vulnerabilities in 2018 alone. Software composition analysis (SCA) focuses on identifying the open source in a codebase so teams can manage their exposure to security and license compliance issues.
The race is on between you and would-be hackers
Organizations employ a variety of methods to combat software vulnerabilities, but time is the enemy. While the “time to compromise” of a breach is most often days or minutes, it can take months to remediate the vulnerability that allowed the breach.
Open source vulnerabilities pose additional security risks. Open source is accessible and used everywhere. This fact is not lost on hackers, who can access publicly available information on known open source vulnerabilities along with detailed information on how to exploit them. For example, as soon as a vulnerability is reported, the open source community often also publishes a means to exploit it.
SAST and SCA for different application security challenges
Application security challenges are diverse, so what’s the best way to address them? An effective approach to addressing software vulnerabilities must include security testing tools to find both weaknesses in proprietary code (with SAST) and vulnerabilities in open source code (with SCA).
A software security program that contains both SAST and SCA is more comprehensive. Organizations that adopt such an approach get results:
- Improved product quality through early identification and selection of secure components
- More security risk visibility across proprietary code and open source components
- Lower remediation costs for vulnerabilities detected and fixed early in the development process
- Minimized risk of security breaches from attacks targeted at known open source vulnerabilities
- Optimized security testing that is both effective and compatible with agile development tools and practices
Let’s look more closely at these essential application security testing tools.
Static application security testing
SAST inspects an application’s source code to pinpoint possible security weaknesses. Sometimes called white box testing (because the source code is available and transparent), SAST comes into play early in the software development life cycle (SDLC), when fixing problems is both easier and less expensive. SAST is effective at finding many of the common weaknesses mentioned earlier, such as cross-site scripting, SQL injection, and buffer overflow.
SAST strengths
- Pinpoints flaws in proprietary code
- Finds weaknesses early in the SDLC, when they are much less expensive to fix
- Detects weaknesses before code goes into production (i.e., before they become vulnerabilities)
Software composition analysis
SCA identifies all the open source in a codebase and maps that inventory to a list of current known vulnerabilities. Entry-level solutions simply collect information about the open source that is declared (e.g., libraries) and compare it to the NVD. More advanced solutions use sophisticated source and binary file scanning to ensure that they identify all open source, including code snippets copied from known sources. They also augment NVD data with other vulnerability information to provide more complete and timely reporting. Leading SCA solutions provide ongoing monitoring and alerts for vulnerabilities reported after an application deploys.
SCA strengths
- Reliably detects and maps known open source vulnerabilities that cannot be found by other methods
- Provides a full accounting of the open source in use
- Monitors for new vulnerabilities that are discovered
How to combine SAST and SCA to get a more complete picture
Application security is evolving rapidly, thanks in large part to the proliferation of open source code. With its clear benefits, open source is the foundation of modern application development. Therefore, an application security testing approach that includes only SAST and focuses only on proprietary code can leave significant vulnerability identification and management gaps.
SCA completes the picture, providing automatic identification and inventorying of open source software, mapping components to known vulnerabilities, and streamlining and securing CI/CD activities. An approach incorporating both SAST and SCA supports a comprehensive and in-depth assessment of security across the entire application landscape.
Continue Reading
