Static application security testing

I could probably name drop 15, but I will not tell you that they're valid at this yet.

I will say for the most part right now, Go back to your basics of SAST and DAST.

Understand your dependency checks.

If you've got GitHub, GitLab, or whatever you're using, make sure that whatever you're calling is fine.

La sicurezza del codice rappresenta il fondamento dell'infrastruttura di Emergent, un aspetto cruciale per le istituzioni bancarie, sanitarie e governative che adottano la piattaforma.

Nessuna porzione di codice generata dagli agenti può approdare nel repository principale senza aver superato l'analisi statica di vulnerabilità tramite motori SAST integrati, verificando l'assenza di falle OWASP top 10 come iniezioni SQL, autenticazioni deboli o esposizione accidentale di chiavi crittografiche.

La piattaforma sintetizza ed esegue autonomamente test di carico e verifiche di regressione, simulando migliaia di utenti simultanei per misurare i tempi di latenza delle query di database.

Ogni decisione logica presa dai singoli agenti intelligenti viene registrata all'interno di un registro di conformità immutabile, fornendo ai responsabili della sicurezza una spiegazione dettagliata del ragionamento algoritmico che ha portato alla stesura di ciascuna classe o funzione, garantendo il rispetto delle normative vigenti in materia di trasparenza del software.

The N-O-O-N-I-F-I-C-A-T-I-O-N.

Read code like a hacker with the SAST.

The 4th of May 2024.

The 4th of May 2024.

Codebases with a growing share of AI-generated code that needs testing beyond pattern matching.

Security teams that want to confirm static analysis, SAST findings by exercising the flagged functions live.

It supports C, C++, Rust, Go, Java, Kotlin Net, Node, Python and Crystal, and runs inside the customer's environment with no running application, cloud scanner or authentication required.

In persistent mode, harness execution is about fifty-one times faster than running a new process per input.

And they maybe buy two or three of these different tools.

And the tools kind of talk a little bit about DAST, but they mostly talk of focusing on static application security testing.

Well, what happens is the person just bought three specific tools that do mostly SAST, maybe with a little DAST, and no IAST.

So you're going, oh my gosh, I just bought all these equipment and all these software licenses, but now it's not fully meeting what you want.

So it's imperative that if you're looking at software code that your software, some sort of software that's going to look at your code, you want to make sure that you have it specifically passed for whatever your type that you're looking for.

So again, think about it.

If you have something with SAST, you should have one thing focused on SAST.

You have something that deals with DAST, it should focus primarily on DAST.

You know, I sat with one, um...

Oh, who was it? Data science, data science officer, and their organization, they were doing SAST and DAST.

So code reviews, code scanning.

Like, somebody submits some code, and then they had three engineers that would rev- rev- review the code for any vulnerabilities.

Now, this data science officer decided that they were looking to cut headcount, and these three people that were employed at around 250,000 US dollars a piece, uh, they wanted to fire and replace that with AI.

I was like, "Okay, 750K you're saving, you can do that." At that time, they wanted to use Mythos, you know, Anthropic's frontier model, and they want to use Mythos for the same level of SAST and DAST scannings.

I'm happy with that.

That's fine.

Maybe it's because I'm also doing security engineering nowadays.

The things that we care about in a big company is like, do we have secret scanning in place for everything? Do we have SAST? Do we have DAST? And all these new tooling don't seem to...

hitting the mark on the enterprise stuff if you ask me I mean of course Datadog has solutions for all these things and at great prices so does github but I'm just thinking as a language like for example if you were to create a bun or even even I could even probably nitpick a go the the go security tool tooling just seems like well, it's not part of the language.

What I'm looking for, and yeah, if you see anything, do let me know.

Like AppSec is bigger than it was 10 years ago, 20 years ago.

Uh, there's more people that are doing application security topics or application security activities, but how much of that is the bug janitor? How much of that is consuming DAST and SAST results and doing false positive reduction? Um, I don't know.

I don't have a good feel for that outside of, you know, the few, uh, you know, the companies that I work with where there is that is.

That seems to be the main task given to application security is run these tools in the CICD pipeline and then reduce the false positives.

Well, we have to do the best we can and with the resources we have, of course.

And that's where it comes to the communication of the CISO to actually try to explain to leadership why this is actually a better solution and why we should invest more time in teaching people how to use a better authentication method, why we should invest more time in having SAST or DAST for our software development.

It's not a strict requirement for some compliance, but Creating your controls in a strict way where both becomes compliant and does the best security on a continuous basis because you do that, let's say in January, but maybe if you don't know that maybe there's a new better solution down the path, like in half a year, then you should also be ready to switch your solutions.

Just to jump in there, actually, I just wanted to say there, Christoph, you mentioned about resource, but if you have limited resource, how do you balance mandatory compliance work against a security issue