What is Dynamic Application Security Testing (DAST)?

Dynamic Application Security Testing (DAST) is the process of analyzing a web application through the front-end to find vulnerabilities through simulated attacks. This type of approach evaluates the application from the “outside in” by attacking an application like a malicious user would. After a DAST scanner performs these attacks, it looks for results that are not part of the expected result set and identifies security vulnerabilities.

Pros of DAST

• Independent of the application
• Immediately finds vulnerabilities that could be exploited
• Does not require access to the source code

Cons of DAST

• Does not find the exact location of a vulnerability in the code
• Security knowledge is needed to interpret reports
• Test can be time-consuming

Application development and testing continues to be the most challenging security process for organizations, according to IT security professionals. Developers need solutions to help them create secure code, and that is where Application Security (AppSec) tools come into play.

AppSec is the discipline of processes, tools and practices aiming to protect applications from threats throughout the entire application lifecycle.

There are many ways to test application security, including:

• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Mobile Application Security Testing (MAST)
• Interactive Application Security Testing (IAST)

Why is DAST Important?

DAST is important because developers don’t have to rely solely on their own knowledge when building applications. By conducting DAST during the SDLC, you can catch vulnerabilities in an application before it’s deployed to the public. If these vulnerabilities are left unchecked and the app is deployed as such, this could lead to a data breach, resulting in major financial loss and damage to your brand reputation. Human error will inevitably play a part at some point in the Software Development Life Cycle (SDLC), and the sooner a vulnerability is caught during the SDLC, the cheaper it is to fix.

When DAST is included as part of the Continuous Integration/Continuous Development (CI/CD) pipeline, this is referred to as “Secure DevOps,” or “DevSecOps.”

Analysis of Fortify on Demand (FoD) vulnerability data shows that 94% of over 11,000 Web applications contained bugs in security features, while code quality and API abuse issues have roughly doubled over the past 4 years (2019 Micro Focus Application Security Risk Report).

How does DAST work?

A DAST scanner searches for vulnerabilities in a running application and then sends automated alerts if it finds flaws that allow for attacks like SQL injections, Cross-Site Scripting (XSS), and more. Since DAST tools are equipped to function in a dynamic environment, they can detect runtime flaws which SAST tools can’t identify.

To use the example of a building, a DAST scanner can be thought of like a security guard. However, rather than just making sure the doors and windows are locked, this guard goes a step further by attempting to physically break into the building. The guard might try to pick the locks on the doors or break windows. After finishing this examination, the guard could report back to the building manager and provide an explanation of how he was able to break into the building. A DAST scanner can be thought of in this same way – it actively attempts to find vulnerabilities in a running environment so the DevOps team knows where and how to fix them.

What is a DAST tool that is well-suited for developers?

Micro Focus Fortify WebInspect provides automated dynamic application security testing so you can scan and fix exploitable web application vulnerabilities.

Typically, DAST is done after production since it is emulating attacks on a running application; but by making the decision to “Shift DAST left” (moving DAST earlier in the process of development) you’re able to detect vulnerabilities sooner, which saves time and money. Fortify WebInspect includes pre-built scan policies, balancing the need for speed with your organizational requirements.

Fortify WebInspect also includes an incremental scanning feature, which allows you to rapidly asses vulnerabilities in only the areas of the application that have changed.

Fortify WebInspect allows you to:

• Secure DevOps with automated DAST
• Manage AppSec risk at scale
• Achieve compliance with major data security regulations
• Shift DAST left
• Crawl modern frameworks and APIs
• Build a stronger AppSec program

What is the difference between SAST and DAST?

DAST attacks the application from the “outside in” by attacking an application like a malicious user would. After a DAST scanner performs these attacks, it looks for results that are not part of the expected result set and identifies security vulnerabilities.

SAST, on the other hand, analyzes static environments, meaning the source code of an application. It looks at the application from the “inside out,” searching for vulnerabilities in the code.

To maximize the strength of your security posture, it’s a best practice to use both SAST and DAST. Having this unified taxonomy across testing methods enables you to have a complete view of vulnerabilities.

At Micro Focus Fortify...

We improve your SDLC with Dynamic Application Security Testing (DAST). Fortify WebInspect provides the technology and reporting you need to secure and analyze your applications. By design, this and other Micro Focus tools bridge the gap between existing and emerging technologies – which means you can innovate faster, with less risk, in the race to digital transformation.

Fortify offers the most comprehensive static and dynamic application security testing technologies, along with runtime application monitoring and protection, backed by industry-leading security research.