Some time ago about what is SAST and DAST emerged in one of the community threads which inspired me to write this short article explaining the difference between SAST, DAST, IAST and RASP using a clever analogy.
Before we start explaining the terms, try to imagine yourself as a castellan who is concerned about protecting his castle (your computer system) from the savage raiders (cyber threats).
SAST - Static Application Security Testing
Naturally, you would want to prevent most of the issues when the castle is not yet built. I mean, it's much easier to change the design of a certain wall before it is built rather than after it's already standing. And how to spot the potential issues? By carefully examining the blueprints and looking for the issues. This is when SAST (Static Application Security Testing) comes into play. When looking for flaws using SAST, the castellan should ask himself questions such as: "Do the walls have the right thickness? Are the guard towers positioned at optimum vantage points? Are there any secret passages that could be exploited by the enemy?". To find the answers, SAST scans the source code, byte code, or application binaries without executing the program.
Compared to its counterpart which you'll learn later, the SAST tool allows for removing the possible issues early in the development process. Because you need access to the codebase SAST is considered an example of white-box testing.
| Advantages | Disadvantages |
| Early detection: Identifies vulnerabilities during the development phase, even before the application is run. | Might generate false positives: Since it does not execute the code, some detected issues might not be exploitable in a real-world scenario. |
| Comprehensive: Covers the entire codebase. | Cannot detect runtime vulnerabilities or issues related to the application's specific environment or configuration. |
DAST - Dynamic Application Security Testing
Imagine that the castle is now built. DAST (Dynamic Application Security Testing) is like testing the castle's defenses while it's in operation without the need to have access to its blueprints. In this case, the castellan could hire the raiders to test whether the gate would hold firm if the guards reacted timely, or if the moats were deep enough. Compared to SAST, DAST is a real-time validation that checks the running applications from the outside a looks for vulnerabilities (these can be misconfigurations as well) that may be exploited during the operation. DAST is considered a black-box testing.
| Advantages | Disadvantages |
| Real-world scenarios: Finds vulnerabilities that are exploitable during the application's actual operation. | Late detection: Identifies vulnerabilities after the application is developed, which might be costly to fix. |
| Environment-specific: Can identify issues arising from a particular configuration or environment. | Can't provide insights into the exact location or root cause in the code. |
IAST - Interactive Application Security Testing
When you combine SAST and DAST, you usually get something called IAST (Interactive Application Security Testing). Let's say that there are observers within the castle that monitor how things operate when you are under attack and they are cross-referencing with the castle's design. These observers can then give real-time feedback to the castellan who will be informed about which weak points became visible during the skirmish and help formulate and make informed decisions based on the information received.
IAST tools analyze code for vulnerabilities while the application is running, combining aspects of both static and dynamic testing.
| Advantages | Disadvantages |
| Real-time feedback: Combines the insights from the code (like SAST) and the running application's behavior (like DAST). | Overhead: The monitoring agents might introduce some overhead to the application's performance. |
| Accurate: Less likely to produce false positives compared to SAST. |
RASP (Runtime Application Self-Protection)
What if we had a super modern castle with its automated defenses? If invaders approach, the castle itself detects them and takes immediate action such as activating traps or shutting gates without waiting for the guards or commanders to give an order. That is what RASP (Runtime Application Self-Protection) is all about as it can detect and block attacks in real-time, directly within the application as it runs, without needing external intervention.
| Advantages | Disadvantages |
| Self-defense: Acts immediately against threats without external intervention, thus providing a protective shield for applications. | Performance impact: Because RASP is continuously monitoring the application, it might introduce a performance overhead. |
| Real-time: Identifies and responds to threats as they arise during the application's operation. | Complexity: Implementation can be complex, especially for legacy applications. |
