Interactive Application Security Testing (IAST)

Application security testing describes the various approaches used by organizations as they attempt to find and eliminate vulnerabilities in their software. Also referred to as AppSec testing and AST, application security testing is the process of testing, analyzing, and reporting on the security level of a software application as it moves through the software development lifecycle (SDLC).

Why is IAST important?

Interactive application security testing (IAST) combines static application security testing (SAST) with dynamic application security testing (DAST) to create a synergistic and self-learning interactive application security testing approach. With IAST, interactive application security testing techniques cover more code, produce better results, and verify a broader range of security rules faster than either SAST or DAST tools working alone.

Continuous vs. a Snapshot in time

In Gartner research, 84% of breaches exploit vulnerabilities in the application layer. Because SAST, DAST, and penetration testing only provide a snapshot in time, they can’t keep up with today’s agile software development lifecycle processes or the ever-evolving threat landscape. This means that development, ops, and security teams are always at least one step behind as they develop, test, and move software into production.

The power of IAST

IAST security solutions, on the other hand, deploy agents and sensors that continuously monitor and analyze applications from within as they run. Because they are self-learning, they produce real-time analysis as software is being developed and tested. This makes them ideal for Agile, DevOps, and DevSecOps environments as they enable IT to find and fix security flaws early in the SDLC when they are easiest and cheapest to remediate.

Imagine if you could identify vulnerabilities at DevOps speed, stopping attacks before they occur, and preventing problems before they can do real damage to your organization. Contrast has broken through legacy barriers with an innovative, automated IAST security solution, Contrast Assess, that infuses software with vulnerability assessment capabilities to identify security flaws automatically and in real time wherever software is running.

How IAST works

Contrast Assess is a revolutionary IAST solution that puts security expertise into the application itself. This infuses software with vulnerability assessment capabilities so that security flaws can be automatically identified in real time. By providing an embedded (agent-based), scalable, always on solution that fits seamlessly across development and production environments, Contrast Assess accelerates, simplifies, and integrates application security for development, ops, and security teams. And it uses Contrast sensors to provide real-time vulnerability and attack telemetry throughout application workflows – a major improvement over legacy approaches.

7 advantages of IAST over SAST and DAST

When we honestly assess the strengths and weaknesses of SAST vs. DAST vs, IAST, we see that IAST gets far better results across these seven metrics.

1. False Positives: Representing the single biggest weakness in legacy security tools, false positives occur in over 50% of testing results. This increases the workload on scarce security resources and makes it difficult to identify the most critical flaws. IAST, on the other hand, produces the real-time intelligence and continuous visibility necessary to detect and remediate vulnerabilities with virtually no false positives or false negatives.
2. Vulnerability Coverage: Interactive analysis provides the best of static and dynamic testing. Not only do interactive testing tools focus on the most common and most risky flaws found in applications, but they also allow for custom rules to personalize the threat coverage for specific enterprises.
3. Code Coverage: Both static and dynamic testing miss huge portions of most applications. SAST doesn't examine libraries or frameworks, severely limiting vulnerability analysis. DAST can only examine an application's exposed surface. But IAST examines the entire application from the inside – including the libraries and frameworks. So you get far superior coverage over your entire codebase.
4. Scalability: Static and dynamic tools don't scale well. They typically require experts to set up and run as well as interpret the results. But an application’s size and complexity don’t affect interactive application security testing, which can handle extremely large applications in stride.
5. Instant Feedback: Static and dynamic tools get run on a periodic basis, which means the lag time between the mistake and the vulnerability detection could be weeks or even months. IAST provides instant feedback to a developer, within seconds of coding and testing new code. With IAST, developers can be sure they are only checking in "clean" code.
6. No Experts Required: When you buy something, you just want it to work out of the box. IAST interactive tools eliminate months of configuration, tuning, and customization. As the application is exercised, the application is tested – continuously and automatically.
7. Zero Process Disruption: Businesses put a premium on time-to-market. Agile and DevOps strategies limit testing time. Because interactive testing operates transparently during normal QA or unit testing, there is no process disruption. IAST integrates smoothly with existing security testing activities.

The Contrast advantage

Contrast’s unique approach to modern application security produces the real-time intelligence and continuous visibility needed to detect and remediate vulnerabilities with 99% fewer false positives. Leveraging a well-known industry methodology known as deep security instrumentation, Contrast Assess operates unobtrusively during the development and testing of web applications or APIs. This passive approach to security testing eliminates the need for time-wasting and ineffective static security scans. And Contrast Assess provides continuous vulnerability assessment that integrates seamlessly with existing software development lifecycle (SDLC) processes. It also scales across the entire application portfolio, making it ideal for Agile, DevOp, and DevSecOps environments.

• Contrast Assess uses deep security instrumentation that continuously produces accurate analysis.
• It makes application security elastic, giving developers guidance they can immediately act upon.
• It is scalable across the entire application portfolio.
• It provides continuous vulnerability assessment that integrates seamlessly into the SDLC and tool sets that teams are already using.

In addition, Contrast OSS delivers automated open source risk management from development to production. Contrast is the only solution that can identify vulnerable open source components, determine how they are actually used by the application, and prevent exploitation at runtime, all through a single, self-service platform.

Why IAST delivers better results

Here are 8 key reasons why IAST, Contrast Assess, and Contrast OSS deliver superior results:

1. These tools have been purpose-built from the ground up to work interactively with developers as they write and test web applications and APIs.
2. They fuse together the most effective elements of IAST, SAST, and DAST application security testing approaches with configuration and open-source security analyses, delivering them directly into applications.
3. They are a testing solution that can deliver security results as fast as code changes.
4. They embed agents to monitor code and report from inside the app.
5. Security flaws are automatically identified, both in development and across the SDLC.
6. Developers have the tools they need to fix vulnerabilities without security experts.
7. They produce real-time results to find and fix security flaws early when they are easiest and cheapest to remediate.
8. They can scale across the entire application portfolio.

Key features

Contrast Assess and Contrast OSS represent a new kind of security designed for the way today’s software is created.

• Extensive vulnerability coverage: Contrast provides extensive coverage over the most common application security risks, including the OWASP Top Ten.
• Code-level remediation advice: Contrast’s innovative security trace format pinpoints exactly where a vulnerability appears in the code, and how it works. Contrast “speaks the developer’s language,” providing remediation guidance that is easy to understand and implement.
• Third-party code analysis: Like icebergs, 80% of the code in modern applications is “beneath the surface,” lurking in libraries, frameworks, and other components. Applications often have 50 or more of these libraries, comprising millions of lines of potentially vulnerable code.
• Application inventory: You can’t protect what you can’t see. Today’s organizations may have hundreds or thousands of applications, microservices, and APIs – each with multiple instances of different versions installed across development and QA – and they’re all constantly changing. Contrast tracks and continuously feeds information about internal and external web services, and their relationships across an application into a unified security inventory and bill of materials that’s always up-to-date.
• Live application architecture: Contrast automatically generates simple diagrams that illustrate the application’s major architectural components. This information helps the developer quickly identify the meaning of a vulnerability and take decisive action.

For all these reasons and more, Contrast Security would like to welcome you to the wonderful world of real-time, automated, self-protecting software.