Data Integrity Failures Security Logging and Monitoring Failures* Server-Side Request Forgery (SSRF)* Tooling for security testing Security testing techniques scour for vulnerabilities or security holes in applications. These vulnerabilities leave applications open to exploitation. Ideally, security testing is implemented throughout the entire Software Development Life Cycle (SDLC) so that vulnerabilities may be addressed in a timely and thorough manner. There are many kinds of automated tools for identifying vulnerabilities in applications. Common tool categories used for identifying application vulnerabilities include: Static Application Security Testing (SAST) analyzes source code for security vulnerabilities during an application's development. Compared to DAST, SAST can be utilized even before the application is in an executable state. As SAST has access to the full source code it is a white-box approach. This can yield more detailed results but can result in many false positives that need to be manually verified. Dynamic Application Security Testing (DAST, often called Vulnerability scanners) automatically detects vulnerabilities by crawling and analyzing websites. This method is highly scalable, easily integrated and quick. DAST tools are well suited for dealing with low-level attacks such as injection flaws but are not well suited to detect high-level flaws, e.g., logic or business logic flaws. Fuzzing tools are commonly used for input testing. Interactive Application Security Testing (IAST) assesses applications from within using software instrumentation. This combines the strengths of both SAST and DAST methods as well as providing access to code, HTTP traffic, library information, backend connections and configuration information. Some IAST products require the application to be attacked, while others can be used during normal quality assurance testing. Runtime application self-protection augments existing applications to provide intrusion detection and prevention from within an application runtime. Dependency scanners (also called Software Composition Analysis) try to detect the usage of software components with known vulnerabilities. These tools can either work on-demand, e.g., during the source code build process, or periodically. Abstraction is the idea of making more complex things less complex. Security standards and regulations CERT Secure Coding ISO/IEC 27034-1:2011 Information technology — Security techniques — Application security -- Part 1: Overview and concepts ISO/IEC TR 24772:2013 Information technology — Programming languages — Guidance to avoiding vulnerabilities in programming languages through language selection and use NIST Special Publication 800-53 OWASP ASVS: Web Application Security Verification Standard See also Application service architecture (ASA) Common Weakness Enumeration Data security Mobile security OWASP Microsoft Security Development Lifecycle Usable security