{"id":1651,"date":"2022-01-13T14:15:31","date_gmt":"2022-01-13T14:15:31","guid":{"rendered":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/?p=1651"},"modified":"2022-02-23T13:26:38","modified_gmt":"2022-02-23T13:26:38","slug":"application-security-tools","status":"publish","type":"post","link":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/","title":{"rendered":"Application Security Tools: Use for Static Application Security Testing & Software Composition Analysis"},"content":{"rendered":"\n

In the field of application security, there are various concepts for achieving the goal of developing reliable and secure software. In this paper, Static Application Security Testing (SAST) and Software Composition Analysis (SCA) are introduced as important components of application security. Appropriate tools can be used to implement these concepts and increase application security.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\"Symbolical<\/figure>\n\n\n\n
<\/div>\n\n\n\n

SAST Tools<\/h2>\n\n\n\n

Static Application Security Testing is used to examine the code of a software for vulnerabilities and security holes.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How SAST tools work<\/strong><\/strong><\/h3>\n\n\n\n

As part of static code analysis, SAST focuses on compliance with secure coding guidelines and general programming standards. For example, developers can be helped to avoid vulnerabilities listed in the Top 10 of the Open Web Application Security Project (OWASP) or the Top 25 of the Common Weakness Enumeration (CWE).<\/p>\n\n\n\n

SAST tools are part of white-box testing because they require access to an application’s source code. Ideally, SAST is used in two places in software development. First, in the development environment (IDE) of the software developers, in order to detect potential security vulnerabilities as soon as possible while writing program code. It also makes sense to integrate the SAST tool used into the Continuous Integration\/Continuous Delivery (CI\/CD) process. In this way, a static security analysis of the entire source code can be carried out. In addition, it can be ensured that only a code that has been checked by the SAST tool reaches the further stages of the development process such as testing and deployment. The earlier in the software development process a vulnerability or security hole is found, the more cost-effective it is to fix it.<\/p>\n\n\n\n

Some SAST tools provide further functionalities, such as the execution of unit and integration tests. For the sake of completeness, it must be mentioned that SAST is only a single building block to a secure application and should definitely be complemented by other review and testing methods such as code reviews, Dynamic Application Security Testing (DAST), Interactive Application Security Testing (IAST) and manual testing.<\/p>\n\n\n\n

<\/div>\n\n\n\n

SCA Tools<\/h2>\n\n\n\n

Software Composition Analysis serves to simplify and secure the use of free and open source software in software development projects. Free and Open Source Software (FOSS) has long been an important element in many software projects in order to map recurring tasks with reliable and field-tested software components.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Challenges in the use of FOSS<\/strong><\/strong><\/strong><\/h3>\n\n\n\n

However, the use of FOSS gives rise to various risks that affect the application-secure and legally compliant operation of the developed software. FOSS components also have security vulnerabilities that are only discovered in the course of the development or operation of a software. Furthermore, FOSS is protected by legally binding licenses, some of which imply considerable restrictions on its use.<\/p>\n\n\n\n

For these reasons, among others, it is important to know which FOSS is used in which version and under which license it was published. SCA tools support this by automating this process.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Reasons for using SCA tools<\/strong><\/h3>\n\n\n\n

Extensive and recommended SCA tools are able to identify several million FOSS components. This makes it possible to create detailed Bill of Materials (BoM) that provide accurate insight into the FOSS in use. This information can then be used to identify vulnerabilities and security holes from many different sources. Subsequently, good SCA tools create risk and urgency assessments, which are complemented by recommendations for problem solving (FOSS update or workaround). In this way, it is possible to react to new threats to one’s own application within a very short time.<\/p>\n\n\n\n

Many SCA tools can be integrated into highly automated processes such as Continuous Integration\/Continuous Delivery (CI\/CD) or DevSecOps. This makes it possible to react to FOSS vulnerabilities already during application development. Automated scans, which are part of the build process, also offer the possibility of rectification before the application is tested or deployed. From a security point of view, it is highly recommended that the software in operation be scanned at regular intervals by the SCA tool used. In this way, the security of the application with regard to the integrated FOSS components can also be guaranteed in this phase of the software life cycle.<\/p>\n\n\n\n

Licenses under which FOSS is provided are often complex and can restrict the use or distribution of the application. A professional SCA tool recognizes several thousand licenses and supports the identification of license conditions and their effects. In addition, conflicts between different FOSS licenses should be able to be identified and issued as a warning. Furthermore, support in generating the FOSS Disclosure Statement can be part of the functional scope.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Conclusion<\/strong><\/h2>\n\n\n\n

Developing secure software is a time-consuming and labour-intensive process. By integrating SAST and SCA tools into the development process, many manual tasks can be automated and performed with consistent thoroughness. For these and the many other reasons mentioned above, the use of such tools is an elementary part of application security. Therefore, it is essential – also in our software development projects at ZEISS Digital Innovation – to develop reliable, high-quality and, above all, secure software.<\/p>\n\n\n\n

The use of an SAST tool and an SCA tool is an elementary component of application security. It is therefore essential – also in our software development projects at ZEISS Digital Innovation – to develop reliable, high-quality and, above all, secure software.<\/p>\n","protected":false},"excerpt":{"rendered":"

Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln. In diesem Beitrag werden das Static Application Security Testing (SAST) und die Software Composition Analysis (SCA) als wichtige Bestandteile der Application Security vorgestellt. Zur Umsetzung dieser Konzepte und Erh\u00f6hung der Application Security k\u00f6nnen entsprechende Tools eingesetzt werden.<\/p>\n","protected":false},"author":77,"featured_media":1668,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","footnotes":""},"categories":[803,1],"tags":[98],"topics":[81],"class_list":["post-1651","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software-services","category-general","tag-security","topics-security"],"acf":[],"yoast_head":"\nApplication Security Tools - ZEISS Digital Innovation Blog<\/title>\n<meta name=\"description\" content=\"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Application Security Tools - ZEISS Digital Innovation Blog\" \/>\n<meta property=\"og:description\" content=\"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital Innovation Blog\" \/>\n<meta property=\"article:published_time\" content=\"2022-01-13T14:15:31+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-02-23T13:26:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Nico F\u00f6rster\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Application Security Tools\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nico F\u00f6rster\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/\",\"url\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/\",\"name\":\"Application Security Tools - ZEISS Digital Innovation Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg\",\"datePublished\":\"2022-01-13T14:15:31+00:00\",\"dateModified\":\"2022-02-23T13:26:38+00:00\",\"author\":{\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/ea37e522586554a950e41fde6c4db276\"},\"description\":\"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.\",\"breadcrumb\":{\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage\",\"url\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg\",\"contentUrl\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Application Security Tools: Use for Static Application Security Testing & Software Composition Analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#website\",\"url\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/\",\"name\":\"Digital Innovation Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/ea37e522586554a950e41fde6c4db276\",\"name\":\"Nico F\u00f6rster\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2020\/05\/foerster_nico-e1589559893814-150x150.jpg\",\"contentUrl\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2020\/05\/foerster_nico-e1589559893814-150x150.jpg\",\"caption\":\"Nico F\u00f6rster\"},\"description\":\"Nico F\u00f6rster is a computer scientist (B.Sc.) and he has been working as a software developer for ZEISS Digital Innovation since 2014. He works in the field of software evolution and is currently working on the further development and maintenance of an extensive Java enterprise application in the field of rail logistics. His area of interest also includes IT and application security.\",\"url\":\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/author\/ennicofoerster\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Application Security Tools - ZEISS Digital Innovation Blog","description":"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/","og_locale":"en_US","og_type":"article","og_title":"Application Security Tools - ZEISS Digital Innovation Blog","og_description":"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.","og_url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/","og_site_name":"Digital Innovation Blog","article_published_time":"2022-01-13T14:15:31+00:00","article_modified_time":"2022-02-23T13:26:38+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg","type":"image\/jpeg"}],"author":"Nico F\u00f6rster","twitter_card":"summary_large_image","twitter_title":"Application Security Tools","twitter_misc":{"Written by":"Nico F\u00f6rster","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/","url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/","name":"Application Security Tools - ZEISS Digital Innovation Blog","isPartOf":{"@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage"},"image":{"@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage"},"thumbnailUrl":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg","datePublished":"2022-01-13T14:15:31+00:00","dateModified":"2022-02-23T13:26:38+00:00","author":{"@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/ea37e522586554a950e41fde6c4db276"},"description":"Im Bereich der Application Security gibt es verschiedene Konzepte, um das Ziel zu erreichen, zuverl\u00e4ssige und sichere Software zu entwickeln.","breadcrumb":{"@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#primaryimage","url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg","contentUrl":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-scaled.jpg","width":2560,"height":1707},{"@type":"BreadcrumbList","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/application-security-tools\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/"},{"@type":"ListItem","position":2,"name":"Application Security Tools: Use for Static Application Security Testing & Software Composition Analysis"}]},{"@type":"WebSite","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#website","url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/","name":"Digital Innovation Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/ea37e522586554a950e41fde6c4db276","name":"Nico F\u00f6rster","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/#\/schema\/person\/image\/","url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2020\/05\/foerster_nico-e1589559893814-150x150.jpg","contentUrl":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2020\/05\/foerster_nico-e1589559893814-150x150.jpg","caption":"Nico F\u00f6rster"},"description":"Nico F\u00f6rster is a computer scientist (B.Sc.) and he has been working as a software developer for ZEISS Digital Innovation since 2014. He works in the field of software evolution and is currently working on the further development and maintenance of an extensive Java enterprise application in the field of rail logistics. His area of interest also includes IT and application security.","url":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/author\/ennicofoerster\/"}]}},"author_meta":{"display_name":"Nico F\u00f6rster","author_link":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/author\/ennicofoerster\/"},"featured_img":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-content\/uploads\/sites\/3\/2022\/01\/2022-01_Application_Security_S-600x400.jpg","coauthors":[],"tax_additional":{"categories":{"linked":["<a href=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/category\/software-services\/\" class=\"advgb-post-tax-term\">Software Services<\/a>","<a href=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/category\/general\/\" class=\"advgb-post-tax-term\">General<\/a>"],"unlinked":["<span class=\"advgb-post-tax-term\">Software Services<\/span>","<span class=\"advgb-post-tax-term\">General<\/span>"]},"tags":{"linked":["<a href=\"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/category\/general\/\" class=\"advgb-post-tax-term\">Security<\/a>"],"unlinked":["<span class=\"advgb-post-tax-term\">Security<\/span>"]}},"comment_count":"0","relative_dates":{"created":"Posted 4 years ago","modified":"Updated 4 years ago"},"absolute_dates":{"created":"Posted on January 13, 2022","modified":"Updated on February 23, 2022"},"absolute_dates_time":{"created":"Posted on January 13, 2022 2:15 pm","modified":"Updated on February 23, 2022 1:26 pm"},"featured_img_caption":"","series_order":"","_links":{"self":[{"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/posts\/1651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/users\/77"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/comments?post=1651"}],"version-history":[{"count":6,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/posts\/1651\/revisions"}],"predecessor-version":[{"id":1674,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/posts\/1651\/revisions\/1674"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/media\/1668"}],"wp:attachment":[{"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/media?parent=1651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/categories?post=1651"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/tags?post=1651"},{"taxonomy":"topics","embeddable":true,"href":"https:\/\/blogs.zeiss.com\/digital-innovation\/en\/wp-json\/wp\/v2\/topics?post=1651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}