Static Application Security Testing
What is Static Application Security Testing?
A security testing methodology that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the application.
Terms that appear alongside static application security testing
Each of these is named in at least one of the same controls as static application security testing. The number is how many controls name both.
- security testing 3 shared controls
- application security testing 3 shared controls
- application security 3 shared controls
- software composition analysis 2 shared controls
- dynamic application security testing 2 shared controls
Frameworks that govern static application security testing
What the standards actually require on static application security testing
Requirements naming static application security testing across 6 standards, quoted from the control text.
Integrate static application security testing into the delivery workflow as a gating control, so results can block vulnerable code from being committed, built or deployed.
ASBv3-DS-4 · Integrate static application security testing into DevOps pipeline →OSPS-VM-06 Publish and Enforce an Application Security Testing Policy (maturity level 3). Requirement: The project documentation MUST include a policy that defines a threshold for remediation of SAST findings.
openssf-open-source-project-security-baseline-osps-baseline::OSPS-VM-06.01 · OSPS-VM-06.01 Publish and Enforce an Application Security Testing Policy →All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported in...
ISM-2028 · Testing software artefacts for known weaknesses →Software development is to follow secure coding principles. Purpose: have software written securely so that it contains fewer potential security vulnerabilities.
iso-27002-2022::8.28 · Secure coding →Per OWASP DSOMM Test and Verification dimension: implement comprehensive security testing. Requirements include (a) integrate Static Application Security Testing (SAST) in CI/CD with developer feedback + tuning + (b) operate Dynamic Application Security Testin...
DSOMM-4 · Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing →Scorecard checks whether static application security testing runs, looking for CodeQL or SonarCloud apps on recent merged pull requests (about 30) or the github/codeql-action in a workflow. Other SAST tools may go undetected.
openssf-scorecard::SAST · SAST check →Questions people ask about static application security testing
What is Static Application Security Testing?
Why is Static Application Security Testing important for compliance?
Which compliance frameworks address Static Application Security Testing?
Where can I learn more about Static Application Security Testing?
See how Static Application Security Testing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.