Application Security · AS-Q08

Question: Are static (SAST), dynamic (DAST), and dependency (SCA) scans integrated into the development lifecycle?

  1. Objective — Why This Matters
    Security testing embedded in CI/CD reduces cost of fixes and ensures continuous coverage against emerging vulnerabilities.

  2. Maturity Levels (0–5)

0 — Unaware
No automated security testing.
1 — Ad Hoc
Manual scans run before release.
2 — Defined
SAST/DAST/SCA tools selected; usage documented.
3 — Managed
Tools integrated into CI/CD; findings tracked.
4 — Integrated
Build gates block critical issues; metrics reported.
5 — Optimized
Risk-based testing strategy with continuous feedback.
  1. How to Level Up
From → To Actions
0 → 1 Run manual ZAP/SonarQube scans before release.
1 → 2 Document tool selection and scan frequency.
2 → 3 Integrate SAST/DAST/SCA into CI/CD pipelines.
3 → 4 Define build gates to block critical findings.
4 → 5 Analyze trends and prioritize based on risk scores.

  1. People / Process / Technology Enablers
    People – Developers, QA, AppSec.
    Process – Secure SDLC policy and testing schedule.
    Technology – SonarQube, OWASP ZAP, Grype, DefectDojo.

  2. Evidence Required
    Pipeline configuration, scan reports, defect tracking logs.

  3. Metrics / KPIs
    • percentage of builds with security scans executed
    • number of critical issues per application per month
    • average fix time for high severity findings

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
SAST SonarQube / CodeQL Detect code issues.
DAST OWASP ZAP Dynamic vulnerability testing.
SCA Grype / Dependency-Check Identify CVE components.

  1. Common Pitfalls
    Running scans without tracking results; ignoring failed build reports.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.25 / A.8.28.
NIST CSF 2.0 DE.CM-8 / PR.IP-1.
CERT-In 2022 Application testing expectations.
NIRMATA Scoring AS-Q08 ≥ Level 4 requires automated blocking on CI.