TechPrufer
Get started
Microsoft
Microsoft logoMicrosoft · Feature trail

Static Application Security Testing (SAST) Automation

1 post · Aug 2018

What this trail covers

This post introduces a framework for effective Static Application Security Testing (SAST) within DevSecOps, emphasizing the need for relevant patterns, cost-effective detection, and business motivation for fixes. It proposes a formula for calculating the value of static analysis and categorizes findings into 'hot' (immediate, low-noise), 'cold' (deep analysis, scheduled), and 'lukewarm' (discarded) results. A case study with MSRC and Semmle QL demonstrates how static analysis can significantly improve security findings and efficiency.

All Microsoft trails
  1. A Microsoft DevSecOps Static Application Security Testing (SAST) ExerciseThe post introduces a formula for evaluating the value of static analysis, emphasizing that value is derived from actual fixes. It categorizes SAST findings into 'hot' (early, low-noise, blocking PRs), 'cold' (deep analysis, scheduled as issues), and 'lukewarm' (discarded). A case study details how MSRC used Semmle QL to analyze a sensitive, externally authored code base, tripling security findings and enabling analysis across multiple code variants and versions. The analysis was used to validate fixes and provided an automatable process for future servicing.