1. SAST, also known as secure code review, is one of the software security assurance approach to identify security-related weaknesses in the code
  2. It involves detailed systematic inspection of source code to detect vulnerabilities and design flaws
  3. It should be performed toward the end of the source code development when application code is stable or nearly completed
  4. It should always be performed in combination with human effort (Manual) and technology support (Automated)

Objectives of SAST

  • SAST aims to detect application security vulnerabilities are their root cause when code is not running

Root cause analysis (Source to sink)
– Source to Sink analysis (what is the source (input) and the sink (vulnerable code pattern) for any vulnerability) is carried out using Data flow diagrams

Find all Instances of the Common Vulnerabilities
– Security code review enumerates all instances of certain vulnerability

Analyze Effectiveness of Existing Security Controls
 – Security code review enumerates weakness in the existing security control against known threats

Design Analysis
– Design flaws like mishandling of nonuser inputs and external integrations like server-to-server can be easily identified

Identify Uncommon Security Flaws
– Security code review being specific to the application may highlight some flaws like insecure termination of execution flow, synchronization error, etc.

Effective Remediation Recommendations
– Suggests mitigation techniques that can best suit the application instead of a generic one.

Why SAST

  • Many serious security vulnerabilities can be addressed
  • Decreases the remediation cost of vulnerabilities in later stages
  • Deeper analysis is possible with less false positive and negative
  • Help you to add best secure coding practices as per department coding standards which can prevent future security issues

Skills Required for SAST

  1. Able to think from the attacker’s perspective
  2. Working knowledge of the programming language under review
  3. Knowledge of standard, secure coding techniques
  4. Quickly able to detect insecure coding practices
  5. Analytical skills

What to Look for in SAST

  • Look for the code that implements common application security mechanisms
  • The insecure implementation of security mechanisms can render applications vulnerable to various attacks

Common Application Security Mechanisms

  1. Authentication
  2. Authorization
  3. Session Management
  4. Data Validation
  5. Error Handling
  6. Logging
  7. Encryption
  8. Security Configuration

Common vulnerabilities Identified through SAST

  1. SQL Injection
  2. Cross-site Scripting
  3. Authentication Flaws
  4. Cryptographic Flaws
  5. Buffer Overflows
  6. Malicious File Execution
  7. Cross-site Request Forgery
  8. Sensitive Information Leakage

Types of SAST

Automated Source Code Analysis
– It is also known as Static Code Analysis (SCA)
– It uses certain source code analysis tool to scan the code and report potential flaws

Manual Source Code Review
– It involves manually inspecting the source code line by line to detect any defects and security related flaws

Where does SAST Fit in SDLC ?

SAST Steps

  1. Perform an application walkthrough
    – Understand the applications functionality
  2. Developers Interview
    – Talk to developers; more you involve developers, more effective you secure code review will be
    – It will help you quickly
    – Determine the high risk areas
    – Understand developer’s logic behind particular functionality
    – Establish friendly and respectful relationship between you and developers
  3. Analyze threat Model
    – Figure out the major existing security threats
  4. Define secure code review objectives
    – Based on threat model analysis, identify the objectives such as:
    – Code review for all major security vulnerabilities
    – Code review for OWASP top 10
    – Code review for specific vulnerability
  5. Define scope for secure code review
    – Be clear on what to look for and what to avoid
    – Calculate the time and efforts required
    – Define the budget constraints
  6. Categorized the Objectives
    – Prioritize the objective based on severity and requires more attention
  7. Conduct Static Code Analysis
    – Use multiple source code analysis tools to perform secure source code analysis
    – Most common vulnerabilities and flaws are identified
  8. Conduct Manual Source code Review
    – Inspect the application’s code line by line in order to find the use of insecure coding practices
  9. Remediation/Recommendation
    – Suggest secure coding practice for each findings
  10. Prepare Report

SAST Activities-flow Chart