What Is SAST? Static Application Security Testing
SAST reads source code without running it, catching flaws at the cheapest point in the SDLC. A CISSP insight on its strengths, blind spots and CI/CD role.
TOPIC
Software Development Security
Building security into software rather than bolting it on afterwards: where security fits in the development life cycle, what DevSecOps changes, and the testing that finds flaws in your code and in your dependencies. CISSP Domain 8.
Articles
Key terms
A practice that makes security a shared responsibility across development and operations by automating security checks into the CI/CD pipeline instead of a bolt-on review at release.
Black-box testing that probes a running application from the outside, finding runtime and configuration flaws without source access, but unable to point to the offending line of code.
Automated inventory of the third-party and open-source components inside an application, mapping each to known vulnerabilities and licence obligations via a software bill of materials.
The phased process for building and retiring software, from requirements through design, development, testing, operation, and disposal, with security built into every phase from the start.
White-box testing that analyses source code or bytecode without executing the program, catching code-level flaws early in development but missing runtime and configuration issues.