Blog
Static and dynamic analysis combined can lower the overall risk of your application by first assessing each line of code for any flaws followed by identifying how it reacts to different input when executed. Organizations typically choose to do dynamic over static due to cost or compliance, but bundling the two will ensure fewer risks. Below, we have broken down the strengths and weaknesses of both.
Static Analysis
Tools used for static analysis will take your code as input and analyze each line for any insecure functions or coding practices. The tools are great at finding obvious high-risk flaws such as injections, which are the most often discovered findings during our web engagements. Static analysis is often used at organizations that are continuously improving or developing new content.
Static Testing Weaknesses
Cannot identify subjective or business logic related issues
Extremely slow in adopting new versions of programming languages
Requires more effort than dynamic analysis when dealing with tool results
40% gap in covering the OWASP Top 10
OWASP Top 10: 2017 Coverage
Covered: A1 – Injection
Out of scope: A2 – Broken Authentication
Covered: A3 – Sensitive Data Exposure
Covered: A4 – XML External Entities (XXE)
Out of scope: A5 – Broken Access Control
Out of scope: A6 – Security Misconfiguration
Covered: A7 – Cross-Site Scripting (XSS)
Covered: A8 – Insecure Deserialization
Covered: A9 – Using Components with Known Vulnerabilities
Out of scope: A10 – Insufficient Logging & Monitoring
Static Testing Strengths
Quick in identifying obvious coding flaws
Can be run in parallel with development to reduce overhead at the end of the development life cycle
Dynamic Analysis
Dynamic analysis does not see the actual server-side code. Instead, it executes it no different than what you do when you browse a website. The software or individual tester sits between the server and the browser while modifying requests to identify flaws in how the server reacts to them. In order to successfully evaluate an application using dynamic analysis, a skilled tester with advanced knowledge of the tool is required.
Dynamic Testing Weaknesses
Depends heavily on the qualifications of the tester. If the tester is not qualified, some findings will be missed. If you need help on choosing a penetration test company, visit our blog on “How To Choose The Right Penetration Testing Company For Your Business”
If the software fails to catch any existing issues, you will also have missed findings. Back in 2016, sectoolmarket did a comparison of dynamic scanners that covered accuracy and false positives. Prices have changed since then and many of those tools have released newer versions, but it can be used as a baseline in understanding that each tool has its shortcomings.
Dynamic Testing Strengths
Covers all of the OWASP Top 10.
Can be leveraged into checking for more sophisticated attacks by doing additional manual checks.
Each type of assessment can assist in lowering your overall risk, which is why we would recommend doing both during your development lifecycle. If budget is of concern, only do a dynamic test using a reputable company with a strong testing methodology to ensure complete coverage of the OWASP Top 10.