SAST - Static Application Security Testing

What is SAST?

SAST (Static Application Security Testing) is an application security testing method that analyzes source code, bytecode, or binary files without the need to run the application. SAST tools identify security vulnerabilities and issues in code during the development phase, enabling early remediation at significantly lower cost.

85% Cheaper to fix when detected in dev phase

10x Faster than manual code review

24/7 Continuous automated scanning

How SAST Works

SAST tools analyze source code using a combination of static analysis techniques. The process involves parsing the code, building an abstract syntax tree (AST), and then performing data flow analysis and pattern matching against known security patterns.

Source Code Analysis

The SAST tool parses the source code and builds an abstract syntax tree (AST) that represents the program structure.

Data Flow Analysis

The tool traces the flow of data through the application and identifies paths through which untrusted data can reach sensitive functions.

Pattern Matching

The code is compared against a database of known security patterns and anti-patterns (e.g., SQL injection, XSS, hardcoded secrets).

Report Generation

A detailed report is generated with discovered vulnerabilities, including severity (CVSS score), location in the code, and remediation recommendations.

Example: SQL Injection Detection

// Vulnerable code - SAST would flag this
String query = "SELECT * FROM users WHERE username = '" + userInput + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);  // SQL Injection risk!

// Secure code - parameterized query
String query = "SELECT * FROM users WHERE username = ?";
PreparedStatement stmt = connection.prepareStatement(query);
stmt.setString(1, userInput);  // Safe - parametrized
ResultSet rs = stmt.executeQuery();
                    

Popular SAST Tools

Open Source

SonarQube

Comprehensive code quality and security platform supporting 27+ programming languages.

Detailed dashboards and code quality metrics
Quality Gates for automated blocking
Integration with GitHub, GitLab, Azure DevOps
Free Community edition

Enterprise

Checkmarx SAST

Enterprise-grade SAST solution with advanced data flow analysis and low false positive rate.

Advanced data flow analysis
Low false positive rate
OWASP Top 10 and CWE/SANS Top 25 coverage
Compliance support (PCI DSS, HIPAA)

Open Source

Semgrep

Fast and flexible SAST tool with support for custom rules and IaC scanning.

Extremely fast analysis (10-100x faster)
Easy custom rule creation
Support for IaC security scanning
Free tier with core functionality

GitHub Native

GitHub CodeQL

Semantic analysis using QL queries with native GitHub Actions integration.

Semantic analysis using QL queries
Native integration with GitHub Actions
Free for public repositories
Advanced security queries

Enterprise

Veracode SAST

Cloud-based SAST with policy-based reporting and compliance certifications.

Cloud-based analysis (no installation required)
Policy-based reporting
Compliance certifications (NIST, OWASP)
Managed service option

Developer-First

Snyk Code

Real-time scanning in the IDE with AI-powered fix suggestions.

Real-time scanning in IDE (VS Code, IntelliJ)
AI-powered fix suggestions
Developer-friendly UX
Integration with Snyk Open Source (SCA)

Integrating SAST into the CI/CD Pipeline

GitLab CI/CD Pipeline

# .gitlab-ci.yml
stages:
  - build
  - test
  - security
  - deploy

sast-scan:
  stage: security
  image: returntocorp/semgrep:latest
  script:
    - semgrep --config=auto --json --output=sast-report.json
  artifacts:
    reports:
      sast: sast-report.json
  allow_failure: false  # Blocks merge on critical issues
                    

GitHub Actions Workflow

# .github/workflows/sast.yml
name: SAST Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  codeql-analysis:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript, python

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
                    

Best Practice: Security Gates

Configure quality gates in your CI/CD pipeline that automatically block deployment when the SAST tool finds vulnerabilities above a certain severity threshold (e.g., Critical or High).

Benefits and Challenges of SAST

Benefits of SAST

Early detection: Vulnerabilities are discovered during development, not in production
Lower remediation cost: Fixing issues in the dev phase is 85% cheaper than in production
100% code coverage: SAST analyzes the entire codebase, not just commonly used paths
Automation: Scanning runs automatically on every commit/merge
Developer education: Developers learn secure coding practices from reports
Compliance: Helps meet regulatory requirements (NIS2, PCI DSS, GDPR)

Challenges and Limitations

False positives: SAST may report vulnerabilities that are not actual threats
Configuration and tuning: Requires time to properly configure rules
Runtime vulnerabilities: SAST cannot detect issues that only manifest at runtime (DAST covers this)
Triage overhead: Developers must evaluate and prioritize findings
Legacy code: In older codebases, SAST may discover thousands of issues at once

SAST vs DAST

SAST (White-box): Analyzes source code, finds more vulnerabilities, but generates more false positives.

DAST (Black-box): Tests the running application, finds runtime issues, but has limited coverage.

Best approach: Combining SAST + DAST + SCA = comprehensive security testing.

Implementation Guide

Phase 1: Tool Selection

Choose a SAST tool based on:

Supported programming languages
Integration with your CI/CD tools
Licensing costs (open source vs commercial)
False positive rate (trial test on your codebase)

Phase 2: Pilot Project

Start with a single project or team:

Run a baseline scan
Resolve critical and high severity issues
Set up quality gates
Measure metrics (number of findings, time to fix)

Phase 3: Scaling

Expand across the organization:

Establish a central security team for triage
Define SLAs for remediation (e.g., Critical: 7 days, High: 30 days)
Integrate with your ticketing system (Jira)
Regular reporting for management

Phase 4: Optimization

Continuous improvement:

Rule tuning to reduce false positives
Create custom rules
Developer training on secure coding
Automate remediation using auto-fix features