Chapter Title:
Chapter 3: Automation in Application Security Testing
Book Title:
Synopsis
This chapter introduces automation as a response to the limitations of manual security testing, especially in fast-paced, large-scale development environments. It outlines the evolution of security testing alongside software practices, explaining how the rise of agile, CI/CD, and DevSecOps demanded faster, more consistent security assessments. Various automated techniques are presented, including Static Application Security Testing (SAST), which analyzes source code for flaws before execution; Dynamic Application Security Testing (DAST), which simulates real-time attacks; and Interactive Application Security Testing (IAST), which monitors applications during runtime for contextual analysis. Software Composition Analysis (SCA) is discussed as a tool to scan open-source dependencies for vulnerabilities and license issues. The chapter also highlights integration of automated tools into development pipelines, real-time feedback for developers, and the growing shift-left trend. It concludes by noting that automation increases coverage and speed, but cannot replace the human intuition needed for nuanced, logic-based vulnerabilities—thus reinforcing the value of a hybrid security approach.
Pages
Published
Series
Categories
License

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.