Dynamic Application Security Testing
What is Dynamic Application Security Testing?
A security testing approach that evaluates running web applications by simulating external attacks to find vulnerabilities in a deployed environment.
Terms that appear alongside dynamic application security testing
Each of these is named in at least one of the same controls as dynamic application security testing. The number is how many controls name both.
- security testing 5 shared controls
- application security testing 5 shared controls
- application security 5 shared controls
- static application security testing 2 shared controls
- software composition analysis 2 shared controls
- fuzz testing 2 shared controls
- penetration testing 2 shared controls
Frameworks that govern dynamic application security testing
What the standards actually require on dynamic application security testing
Requirements naming dynamic application security testing across 6 standards, quoted from the control text.
Integrate dynamic application security testing into the delivery workflow as a gating control, so results can prevent vulnerable builds reaching production.
ASBv3-DS-5 · Integrate dynamic application security testing into DevOps pipeline →All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported in...
ISM-2028 · All software artefacts are tested to detect known weaknesses using static application secu →Build vulnerability detection into the software development process for the service, using a risk based mix of static and dynamic application security testing, expert code review and monitoring of confirmed flaws in third party libraries, then rate severity an...
C5-PSS-02 · Identification of Vulnerabilities of the Cloud Service →Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;
JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →Test executable software to detect vulnerabilities using dynamic application security testing, fuzz testing, and penetration testing on a defined cadence. Tie test scope to risk and feature changes.
SP800-218-PW.8.1 · Executable Testing for Security →Per OWASP DSOMM Test and Verification dimension: implement comprehensive security testing. Requirements include (a) integrate Static Application Security Testing (SAST) in CI/CD with developer feedback + tuning + (b) operate Dynamic Application Security Testin...
DSOMM-4 · Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing →Questions people ask about dynamic application security testing
What is Dynamic Application Security Testing?
Why is Dynamic Application Security Testing important for compliance?
Which compliance frameworks address Dynamic Application Security Testing?
Where can I learn more about Dynamic Application Security Testing?
See how Dynamic Application Security Testing applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.