Security influencers provide real-world insight and “in-the-trenches” experiences on topics ranging from application security to DevOps and risk management


Is There a 3rd Category of Application Security Tools Beyond Static & Dynamic?

Recently, Clark Coleman asked a very logical question about application security tools:

Can you explain the difference between DAST (Dynamic Application Security Testing) and IAST (Interactive Application Security Testing)? To a novice like me, it would seem that you either analyze a program while it is not running (static) or while it is running (dynamic). Logically, (A) and (not A) cover the possible universe with no room for a third category.

application-security-tools-third-category-1.jpgThe problem, as usual, is naming. What we call DAST means that an application is scanned with HTTP requests in a quest to reveal vulnerabilities based the HTTP responses generated.  What we call SAST means analyzing application code. Putting the names aside, these two techniques don't nearly cover the possible universe of ways to analyze an application's security.

An alternative way of thinking about the problem...

I wrote an article in 2014 to explain why the terms "static" and "dynamic" are misleading.  I proposed an alternative way to organize your thinking about application security tools.

Instead of  thinking of tools as static or dynamic, click here to hop over to DZone and read my guest blog post and learn how to classify them by what information you have available to make decisions.


Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast. Previously, Jeff was co-founder and CEO of Aspect Security, a successful and innovative application security consulting company acquired by Ernst & Young. Jeff is also a founder and major contributor to OWASP, where he served as the Chair of the OWASP Board for 8 years.