What do SAST, DAST and SCA tools do?
Options
- SAST: source code; DAST: running app; SCA: libraries (Correct option)
- They are three different types of database engine
- They are three modern encryption algorithms for TLS
- They only measure the performance of the code
Answer
SAST scans your source code for vulnerabilities without running it; DAST attacks the running application from outside; SCA finds known vulnerabilities in third-party libraries
Why
Security testing happens at different levels:
- SAST (Static Application Security Testing): analyzes source code or bytecode early, e.g. SonarQube, SpotBugs, Semgrep, CodeQL.
- DAST (Dynamic): tests a running app like an attacker would, e.g. OWASP ZAP, Burp Suite.
- SCA (Software Composition Analysis): checks your dependencies against vulnerability databases, e.g. OWASP Dependency-Check, Dependabot, Snyk.
Running these in the CI pipeline is part of "shift left": find problems early, when they are cheap to fix.
Remember
SAST = code, DAST = running app, SCA = libraries.