Dynamic Application Security Testing (DAST) is the process of analyzing a web application through the front-end to find vulnerabilities through simulated attacks. This type of approach evaluates the application from the “outside in” by attacking an application like a malicious user would. After a DAST scanner performs these attacks, it looks for results that are not part of the expected result set and identifies security vulnerabilities.
Application development and testing continues to be the most challenging security process for organizations, according to IT security professionals. Developers need solutions to help them create secure code, and that is where Application Security (AppSec) tools come into play.
AppSec is the discipline of processes, tools and practices aiming to protect applications from threats throughout the entire application lifecycle.
There are many ways to test application security, including:
DAST is important because developers don’t have to rely solely on their own knowledge when building applications. By conducting DAST during the SDLC, you can catch vulnerabilities in an application before it’s deployed to the public. If these vulnerabilities are left unchecked and the app is deployed as such, this could lead to a data breach, resulting in major financial loss and damage to your brand reputation. Human error will inevitably play a part at some point in the Software Development Life Cycle (SDLC), and the sooner a vulnerability is caught during the SDLC, the cheaper it is to fix.
When DAST is included as part of the Continuous Integration/Continuous Development (CI/CD) pipeline, this is referred to as “Secure DevOps,” or “DevSecOps.”
Analysis of Fortify on Demand (FoD) vulnerability data shows that 94% of over 11,000 Web applications contained bugs in security features, while code quality and API abuse issues have roughly doubled over the past 4 years (2019 Micro Focus Application Security Risk Report).
A DAST scanner searches for vulnerabilities in a running application and then sends automated alerts if it finds flaws that allow for attacks like SQL injections, Cross-Site Scripting (XSS), and more. Since DAST tools are equipped to function in a dynamic environment, they can detect runtime flaws which SAST tools can’t identify.
To use the example of a building, a DAST scanner can be thought of like a security guard. However, rather than just making sure the doors and windows are locked, this guard goes a step further by attempting to physically break into the building. The guard might try to pick the locks on the doors or break windows. After finishing this examination, the guard could report back to the building manager and provide an explanation of how he was able to break into the building. A DAST scanner can be thought of in this same way – it actively attempts to find vulnerabilities in a running environment so the DevOps team knows where and how to fix them.
Micro Focus Fortify WebInspect provides automated dynamic application security testing so you can scan and fix exploitable web application vulnerabilities.
Typically, DAST is done after production since it is emulating attacks on a running application; but by making the decision to “Shift DAST left” (moving DAST earlier in the process of development) you’re able to detect vulnerabilities sooner, which saves time and money. Fortify WebInspect includes pre-built scan policies, balancing the need for speed with your organizational requirements.
Fortify WebInspect also includes an incremental scanning feature, which allows you to rapidly asses vulnerabilities in only the areas of the application that have changed.
Fortify WebInspect allows you to:
DAST attacks the application from the “outside in” by attacking an application like a malicious user would. After a DAST scanner performs these attacks, it looks for results that are not part of the expected result set and identifies security vulnerabilities.
SAST, on the other hand, analyzes static environments, meaning the source code of an application. It looks at the application from the “inside out,” searching for vulnerabilities in the code.
To maximize the strength of your security posture, it’s a best practice to use both SAST and DAST. Having this unified taxonomy across testing methods enables you to have a complete view of vulnerabilities.
We improve your SDLC with Dynamic Application Security Testing (DAST). Fortify WebInspect provides the technology and reporting you need to secure and analyze your applications. By design, this and other Micro Focus tools bridge the gap between existing and emerging technologies – which means you can innovate faster, with less risk, in the race to digital transformation.
Fortify offers the most comprehensive static and dynamic application security testing technologies, along with runtime application monitoring and protection, backed by industry-leading security research.
