From the course: Application Security in DevSecOps

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

Continuous static scanning

Continuous static scanning

From the course: Application Security in DevSecOps

Start my 1-month free trial Buy for my team

Continuous static scanning

“

- [Instructor] Now we'll dive into the practical application of security testing tools and how to integrate them into the DevOps pipeline. We'll cover several key types of application security testing, discussing what they are, how they can be automated, and walking through live demos. We'll start with static security analysis, which has been a foundational application security practice for many years. Static security testing involves analyzing the application source code to identify potential vulnerabilities without executing the code. The key advantages are it's an early shift-left security check in the development lifecycle, and it can catch certain classes of vulnerabilities that are difficult to find through dynamic testing. It's language-specific, so you have to use tools tailored to the languages in the code base. The potential downsides are that some static analysis tools can generate a high volume of false positives, requiring careful tuning and configuration. Maintaining an…

Contents