What is Dynamic Application Security Testing?: DAST Tools for Security Testing

Organizations across all industries are transforming digitally to keep up with the competition. Modern software development that fuses velocity and agility allows for faster release cycles—helping organizations deploy in days instead of weeks. A critical part of shifting to sophisticated application infrastructures is application security—enabling organizations to detect and remediate vulnerabilities in development and testing and protect them in production from threats such as sensitive data exposure.

But as development teams have embraced DevOps and Agile practices, application security testing (AST) has not evolved to meet the new speed and flexibility requirements of modern software. One the AST tools organizations use is dynamic application security testing (DAST).

What is dynamic application security testing, or DAST?

Dynamic Application Security Testing (DAST) is a vulnerability assessment tool used to find application vulnerabilities in production. The word "dynamic" in its name is due to application security testing usually being performed in a dynamic environment. Developers use DAST vulnerability scanning to monitor an application’s behavior and observe its reaction to staged attacks. These staged attacks are developed and configured without any knowledge of the application’s architecture or internal source code, attempting to take on a hacker’s approach to exploit an application vulnerability. DAST is not the only tool used in AST; it is most often combined with other tests that look for vulnerabilities at different stages in the software development life cycle (SDLC).

How does dynamic application security testing (DAST) work?

DAST works by simulating automated attacks on an application to trigger unexpected results. The development and configuration of DAST tools require highly skilled security experts with in-depth knowledge of application security testing, web and application servers, databases, access control lists, and much more. DAST testing targets applications from the outside using attacks like brute-force attacks, cross-site scripting (XSS) attacks, and SQL injection attacks. Because the application is targeted externally, DAST tools have no access to an application’s source code and thus are often accompanied by other tools for more effective methods of application vulnerability management.

DAST in combination with SAST

Static application security testing (SAST) is used in combination with DAST for a look at the application from the inside out. When developers prepare and run SAST scans, they do so with the knowledge of source code and binaries. What SAST scanning does is essentially scan code line by line searching for issues. One advantage of SAST tools is that it helps developers identify the exact locations of code that is vulnerable to an application attack. Another is that it gives developers a chance to test code before the application is in running state. It costs much less to solve issues before the application is deployed, going up 100 times more once code is in production.

SAST vs. DAST

SAST tools and technologies analyze the source code, leading developers directly to issues. It is also much more cost-effective. DAST extends application security further into the SDLC, taking place in the production phase. DAST scans are configured without any prior knowledge and use a library of potential attacks to test potential application weaknesses through staged application attacks. Developers and security teams use these legacy application security tools along with penetration testing as part of their vulnerability management plan, relying on the insights of one to make up for the limitations of the other.

Limitations with DAST and legacy application management methods

As mentioned above, DAST is used in combination with other tools, unable to provide an overall look at an application’s health and behavior. Stacking up tools at different points in the SDLC complicates things, taking a team of highly skilled experts to oversee testing and propose solutions. As application development moves to DevOps and Agile speeds, these legacy application security methods are falling behind, providing inaccurate results, wasting time, and driving up costs.

Dynamic application security tools produce inaccurate results

DAST tools rely on signature-based engines that process inputs based on a set of protocols. The configurations of signature-based engines often lead to misinterpretation of inputs, producing false positives and/or false negatives. Security teams stage attacks with DAST tools but are limited to libraries of known attacks, leaving unknown or zero-day vulnerabilities unresolved. These inaccurate results get in the way of development and prevent organizations from keeping up with demand.

Legacy application security methods waste time

The inaccuracies produced by legacy application security tools waste developers’ time. Estimates show that, in the span of one year, organizations spend more than 21,000 hours investigating false positives, which leads to alert fatigue. Studies show that more than 4 out of 10 organizations deal with over 10,000 alerts a day, holding up production as a team of experts must comb through results—identifying those that are true vulnerabilities and prioritizing them to be fixed. Triage, diagnosis, prioritization, remediation, and verification of fixes consumes a huge amount of time on the part of developers and application security specialists. For example, over 40% of developers spend more than six hours remediating each vulnerability.

Piling up vulnerability scanning tools drives up cost

Diagnosis and triage of results produced by DAST tools require knowledgeable and skilled application security teams. But with more and more applications in development and finite application security resources, this creates a serious problem with scale. It also creates roadblocks to release cycles, impeding digital transformation initiatives. One of the challenges is the lack of context in the vulnerabilities application security teams tag and hand off to developers to fix. Indeed, nearly three quarters of developers indicate they struggle to find and fix vulnerabilities due to the lack of context. Additionally, the risk of a vulnerability slipping past DAST tools can have grave consequences, including a data breach or sensitive data exposure of personally identifiable information (PII). The latest Cost of Data Breach Report from IBM and Ponemon Institute shows an average cost of a data breach at $3.86 million.

Modern application security—continuous and accurate

Keeping up with the speed and flexibility demands of the business requires a new approach to application security—one that is continuous and accurate and embedded within software.  

Interactive vulnerability management

Interactive application security testing (IAST) provides organizations with an automated approach to vulnerability management. Using instrumentation, sensors are embedded within the application to continuously monitor and accurately locate vulnerabilities as code is written. With IAST, developers no longer need to stop writing and releasing code to chase down vulnerabilities and fix them. Rather, they are able to use automatic vulnerability detection and remediation confirmation to easily and quickly address vulnerabilities that are inadvertently introduced.

Instrumentation enables monitoring to extend past source code into frameworks, back-end connections, and HTTP requests with runtime application self-protection (RASP). RASP is integrated into application runtime, providing accurate and real-time results. RASP works alongside instrumentation and stops and insertion and execution of malicious inputs before they can exploit an application vulnerability. With accurate results and real-time monitoring, false positives are no longer an issue, giving developers valuable time back to meet industry development needs and keep up with the speed and agility of modern application development.