Static Application Security Testing
What is Static Application Security Testing?
A security testing methodology that analyzes source code, bytecode, or binary code for security vulnerabilities without executing the application.
Terms that appear alongside static application security testing
Each of these is named in at least one of the same controls as static application security testing. The number is how many controls name both.
- security testing 3 shared controls
- application security testing 3 shared controls
- application security 3 shared controls
- software composition analysis 2 shared controls
- dynamic application security testing 2 shared controls
Frameworks that govern static application security testing
What the standards actually require on static application security testing
Requirements naming static application security testing across 4 standards, quoted from the control text.
Integrate static application security testing into the delivery workflow as a gating control, so results can block vulnerable code from being committed, built or deployed.
ASBv3-DS-4 · Integrate static application security testing into DevOps pipeline →All software artefacts are tested to detect known weaknesses using static application security testing (SAST), dynamic application security testing (DAST) or software composition analysis (SCA), depending on the software artefact type, before being imported in...
ISM-2028 · All software artefacts are tested to detect known weaknesses using static application secu →Vulnerability Management is a core technical control area per FSA Cybersecurity Guidelines. (1) Vulnerability Discovery: (a) Authenticated and Unauthenticated Scanning - Nessus + Qualys + Rapid7 + open source; (b) DAST Dynamic Application Security Testing;
JP-FSA-CYB-Vulnerability-Management-Patching-CVE-Risk-Based-Prioritisation-Penetration-Testing-Red-Team · Japan FSA Cybersecurity Vulnerability Management + Patching + CVE Tracking + Risk-Based Prioritisation + Penetration Testing + Red-Team + Bug Bounty + Coordinated Vulnerability Disclosure + Zero-Day Response →Per OWASP DSOMM Test and Verification dimension: implement comprehensive security testing. Requirements include (a) integrate Static Application Security Testing (SAST) in CI/CD with developer feedback + tuning + (b) operate Dynamic Application Security Testin...
DSOMM-4 · Test and Verification - SAST, DAST, IAST, SCA, Penetration Testing →Questions people ask about static application security testing
What is Static Application Security Testing?
Why is Static Application Security Testing important for compliance?
Which compliance frameworks address Static Application Security Testing?
Where can I learn more about Static Application Security Testing?
See how Static Application Security Testing applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.