OWASP AppSecUSA 2012: Interactive Application Security Testing(IAST), Beyond SAST/DAST
Speaker:
Ofer Maor
Until recently,
SAST/
DAST dominated the application security testing market, each with its own pros and cons. We present
IAST, a completely new approach - analyzing code execution, memory and data in runtime, allowing for accurate inspection of the application. We will discuss IAST technology (introduced into the
2011 Hype Cycle) compared with DAST/SAST, and the benefits it provides.
The goal of the talk is to examine and discuss technological concepts rather than specific products or solutions, and includes a technical drill-down into the technology specifics. The talk will begin by presenting the standard IAST building blocks and their benefits, and continue by showing advanced IAST data analysis capabilities, which allow for a deeper analysis of the application and
...