 |
Secondly, on the coding & testing stage which is execute phase according to PMBOK, implementation process will be used. The activities have meeting, documentation, software (code) composition analysis (SCA), static application (code) security testing (SAST), and interactive application (binary) security testing (IAST). SAST is a white-box testing tool and is used to scan an application¡¯s source, binary, or byte code. It identifies the root cause of vulnerabilities and helps remediate the underlying security flaws and is a frequently used on application security. SAST analyzes an application from the ¡°inside out¡± and do not reed a running system to perform a scan. IAST analyzes code for security vulnerabilities while the application is run by testing, or any activity ¡°interacting¡± with the application functionality and reports vulnerabilities in real-time, which means it does not add any extra time to your CI/CD pipeline. |
IEEE/ICACT20220036 Slide.12
[Big Slide]
[YouTube]