What is dynamic application security testing (DAST)?

How does DAST work?

DAST occurs once the application has advanced past its earlier life stages and has entered into production or runtime. Most DAST tools only test the exposed HTTP and Hypertext Markup Language interfaces of web-enabled apps. However, some are specifically designed for nonweb protocols, such as Remote Procedure Call and Session Initiation Protocol, and data malformation.

DAST is a type of black box testing, meaning it is performed from the outside of the application, without a view into the internal source code or app architecture. As a result, the test identifies vulnerabilities using the same techniques a hacker would. A DAST might employ a fault injection technique to uncover threats such as cross-site scripting or Structured Query Language injection.

DAST tools continuously scan apps during and after development. DAST crawls through a web app before scanning it, enabling it to find every exposed input on pages within the app and then test each one.

The tests performed after the app has been executed are fully automated and enable businesses to immediately identify and resolve any risks before they become serious attacks. Once a vulnerability is discovered, a DAST tool sends an automated alert to the appropriate team of developers so they can remediate it.

DAST works best as part of a comprehensive approach to web application security testing, in conjunction with other test types. While DAST gives security teams timely insight into the way web applications behave in production, companies often deploy additional forms of security testing, such as application penetration testing and static application security testing (SAST), along with DAST. Application penetration testing offers a real-world demonstration of how an attacker might break into a specific web app, and SAST lets developers find vulnerabilities in the application source code earlier in the software development lifecycle (SDLC).

What are the benefits of DAST?

The major benefit of DAST tools is the ability for businesses to better understand how their web apps behave from the perspective of hackers. This enables businesses to save time and money by removing weaknesses and stopping malicious attacks before they happen. It also lets businesses create a more accurate simulation of hacker behavior.

DAST can also analyze problems in runtime that cannot be identified by static analysis, such as authentication, server configuration issues and flaws that are only visible when a known user logs in.

Furthermore, many DAST tools are language-agnostic and interact with applications from the outside. This enables DAST tools to work with any programming language and framework. It also puts the DAST scanner in an ideal place to identify potential configuration issues within the app.

DAST is also beneficial for industry-standard compliance. It can streamline Payment Card Industry Data Security Standard compliance and other types of regulatory reporting.

What are the limitations of DAST?

DAST tools can create false positives. A false positive refers to the outcome of a test that wrongly indicates a vulnerability, presenting the threat as a reality when it is not. While the tool is correct to report it because it could be a real threat in some scenarios, it can take experienced code analysts to identify whether or not the risk applies to their situation.

DAST tools also cannot be used with source code because they operate in runtime. This prevents testing teams from using the tool to find the exact location of the bug in source code -- it sees the application from the hacker's point of view and does not have complete visibility into the application. The programming team responsible for the code must return and refamiliarize themselves with the code before they are able to fix it; this is a time-consuming process.

DAST also generally occurs later in the SDLC. Testers must use other methods, such as SAST, to find vulnerabilities earlier in the SDLC.

These tools are not made to find vulnerabilities in code that is not executed at runtime. They do not have full code coverage.

DAST vs. SAST

As mentioned before, DAST is frequently used with SAST because the two tests cover different areas in comprehensive testing and can create a fuller security evaluation when used together. DAST is a black box security testing method and performs its analysis from the outside, while SAST is a white box testing method that examines the app from the inside.

SAST does not find runtime errors like DAST does, and DAST cannot flag specific coding errors, down to the code line number, like SAST can. DAST involves operational testing, while SAST looks at source code and speculates where security risks might be or spots design and construction flaws that might present a potential vulnerability.

SAST tools can pinpoint exactly where in the code a vulnerability can be found, something DAST tools are unable to do. However, while SAST is efficient at finding an error in a line of code, it cannot easily find flaws in data flow. Furthermore, SAST is more likely to produce false positive results, making it less reliable than DAST tools.

Importance of DAST

As use of web applications increases and applications become more complex, the risk of cybercrime rises as well. Web application security should be a priority at all stages of the SDLC. The runtime tests performed by DAST tools can catch threats or vulnerabilities that are sometimes only visible after an app is active, successfully shielding the app against external attacks.