How to Deploy and Perform Application Security Testing

Analysis

• The Analysis
  • Implementing the Three Phases of AST
  • AST During Development
  • AST During Prerelease Testing
  • AST in Production Environments
• Integrating AST With Remediation
• Addressing Common Challenges With AST Types
  • SAST Challenges
  • DAST Challenges
  • IAST Challenges
• Adapting AST to Specific IT Scenarios
  • AST for Legacy Applications
  • AST for Outsourced Development and Off-the-Shelf Applications and Components
  • AST for Cloud and Externally Hosted Applications
  • AST for Modern Web Applications, Mobile Applications and Associated Web APIs
  • AST for the Internet of Things and Operational Technology Architecture
  • AST for Malicious Code
  • AST in Continuous Integration and Continuous Delivery

Guidance

• Test in Depth All Critical and Exposed Applications — Regardless of Pedigree — at Least Once
• Implement a Three-Phased AST Approach to Improve Security and Reduce Cost
• Operationalize AST by Integrating With Security, Development and Operations Practices

The Details

• Creating Effective and Efficient AST Capabilities
  • Application Security Vulnerabilities by the Numbers
  • AST Methods
  • The Importance of AST-Related Tools and Methods
  • Examples of AST Tools and Services
  • AST Deployment Types
  • Evaluating AST Vendors and Tools
• Open-Source Software Hygiene
  • A Brief Primer on CVEs
  • Open-Source Licenses
  • SCA Differentiation

Gartner Recommended Reading