How to run an interactive application security test (IAST): Tips & tools

May 28, 2021 by

Nitesh Malviya

There are several popular approaches to testing and securing websites, including: 

1. Dynamic application security test (DAST)
2. Interactive application security test (IAST)
3. Static application security test (SAST)
4. Software composition analysis (SCA)

In this article, we will focus on the IAST aspect of securing web applications.

11 courses, 8+ hours of training

Learn cybersecurity from Ted Harrington, the #1 best-selling author of "Hackable: How to Do Application Security Right."

See Courses

Interactive application security test 

Interactive application security test  (IAST) is a relative newcomer in the application security testing market and combines some elements of both SAST and DAST. 

IAST involves analyzing and detecting vulnerabilities while the application is running. IAST identifies the vulnerable line of code and informs developers of proper measures so the issue can be remediated promptly. IAST looks at the code itself in a post-build stage through the instrumentation of the code. Thus, IAST combines some elements of both SAST and DAST and it was designed to overcome the limitations of both SAST and DAST.

IAST being highly scalable makes it easy to integrate into the continuous integration and continuous deployment (CI/CD) pipeline and can be automated or looked upon by a human tester. 

How does IAST work

A typical IAST makes use of sensors and agents in the application post-build stage. The agent identifies the application’s functionality and analyzes the traffic flow for identifying security vulnerabilities. This is done by mapping external signatures to the given source code, which helps to identify and locate complex vulnerabilities in the application code. 

By now, one should have realized IAST works from inside the application, unlike DAST and SAST. However, IAST does not scan the entire code, instead, it tests a few functionalities of the application only at certain points as defined. This makes IAST significantly faster to work than SAST but fails to provide the complete coverage as provided by SAST.

Important features for an IAST

It is recommended that the below features must be available or provided by a typical IAST software:

1. Refined security dashboards for various standards compliance
2. Accurate, comprehensive and fast results with low false positives
3. Automated identification and classification of vulnerabilities
4. Easy to deploy in CI/CD Pipeline
5. Enterprise-level software composition analysis and binary analysis integration
6. Detailed security remediation advice
7. Compatibility with various types of testing methods

Pros and cons of IAST

Pros

• IAST produces a low false-positive rate, unlike SAST, which is known for high false-positive rates.
• IAST is highly scalable and can be deployed for every developer in the organization.
• IAST provides scan results directly to the developers in real-time and integrates well with CI/CD tools.

Cons 

• IAST is language-specific and supports certain languages and modern technology frameworks.
• The test environment must be matured and well-defined to reap maximum benefit from IAST.
• IAST has been in the market for years but has not been well adopted and still doesn't have a stronghold in the market.

Running an interactive application security test can be very beneficial. Take time to explore the tools at your disposal before choosing which one to use. 

Sources:

What is IAST? Interactive application security testing, Veracode

Does IAST fit into your AppSec program?, WhiteSource

Eight must-have features in an IAST solution, Synopsys

Interactive application security testing (IAST), Synopsys