0:00 Music 0:07 So what is SAST? 0:10 The first question. 0:12 It is static application security testing. 0:15 Why do we need this stuff? 0:18 We need this stuff to find issues in the applications before they went live. 0:26 So basically, there are different tools which can help you to analyze your 0:34 mobile application and your website or desktop application for vulnerabilities. 0:44 So basically, what are the issues which we can find in the code, which can cause vulnerabilities? 0:55 We are going to discuss in a minute. 0:57 And how AI can help us? 1:00 This one I will also show you. 1:02 Static analysis is basically analyzing your source code. 1:07 Based on the known patterns for vulnerabilities. 1:13 And additionally, it is searching for libraries which can be vulnerable. 1:18 So when you develop your application, 1:23 It's a big chance that if you don't follow the best 1:30 security practices, it can be vulnerable. 1:33 So you can create the application vulnerable and just deploy it, run the web vulnerability scanners and not find vulnerability. 1:46 And you will be happy about it, but in reality, 1:50 Web vulnerability scanner can just skip it or not catch it. 1:54 So when you're doing the static analysis, you have more chances to find vulnerabilities than you are doing penetration testing. 2:04 Why? 2:04 Because based on my experience, the difference in reports 2:09 like maybe for penetration testing report of regular web application, it can be maybe like 50 or 100 pages of report for SAST. 2:20 It can be at least 100 pages of report for basic application because 2:30 Some things are inside the admin panel. 2:33 Some things are maybe inside that Docker. 2:39 Some things are inside the Kubernetes. 2:46 And you can find vulnerabilities in those items. 2:50 So how AI can analyze that stuff and how AI can find those vulnerabilities. 2:58 So AI knows. 3:01 AI knows all the patterns usually, and based on those patterns, it can analyze the code and find the vulnerabilities, right? 3:11 But on top of the regular patterns matching, AI can find also logical vulnerabilities. 3:20 So just to be clear, regular SAST applications, they usually cannot find vulnerabilities on the logic. 3:33 So logical vulnerabilities are usually skipped by scanner because logical vulnerabilities cannot be found by web scanner usually. 3:44 Cannot be fine by static analysis. 3:46 So let's imagine that your application is a bank application. 3:51 And that bank application is providing you with the ability to transfer funds from one account to another account. 4:02 Web scanner can do and what static analyzer can do. 4:07 They both can analyze the source code and try to find common web vulnerabilities like SQL injection, XSS, or some potential issues with remote command execution or CSRF. 4:23 So they are limited to amount of models which they have. 4:28 But in the 4:30 A bank application, one person is sending money to another person. 4:35 And there is no way that SaaS can understand it. 4:39 So static application cannot understand the logic. 4:42 It doesn't get to understand the deep... 4:51 Business behind that application. 4:54 So, for example, if you exchange currency on your website, right? 4:59 So maybe like four or five months ago, we were doing penetration testing for the bank application where one of guys found very interesting vulnerability. 5:10 He was able to exchange one currency on another currency. 5:16 And from the second currency, he was able to exchange on third currency. 5:22 And from the third currency, he was buying the first currency. 5:25 And he was profiting with that simple cycle of exchanges. 5:31 So for some reason, the gap between exchanges was wrong. 5:38 So how SAS can understand it, the static analysis? 5:42 It cannot. 5:43 How web scanner can understand it? 5:45 It cannot. 5:47 AI can understand this because AI can create the logical connections. 5:55 Static analyzer cannot create logical connections. 5:58 They just analyze. 6:01 like one file or multiple files or interconnected files, but it cannot understand what this application is doing. 6:10 Without AI, that feature was not available.
0:00 Music 0:07 So what is SAST? 0:10 The first question. 0:12 It is static application security testing. 0:15 Why do we need this stuff? 0:18 We need this stuff to find issues in the applications before they went live. 0:26 So basically, there are different tools which can help you to analyze your 0:34 mobile application and your website or desktop application for vulnerabilities. 0:44 So basically, what are the issues which we can find in the code, which can cause vulnerabilities? 0:55 We are going to discuss in a minute. 0:57 And how AI can help us? 1:00 This one I will also show you. 1:02 Static analysis is basically analyzing your source code. 1:07 Based on the known patterns for vulnerabilities. 1:13 And additionally, it is searching for libraries which can be vulnerable. 1:18 So when you develop your application, 1:23 It's a big chance that if you don't follow the best 1:30 security practices, it can be vulnerable. 1:33 So you can create the application vulnerable and just deploy it, run the web vulnerability scanners and not find vulnerability. 1:46 And you will be happy about it, but in reality, 1:50 Web vulnerability scanner can just skip it or not catch it. 1:54 So when you're doing the static analysis, you have more chances to find vulnerabilities than you are doing penetration testing. 2:04 Why? 2:04 Because based on my experience, the difference in reports 2:09 like maybe for penetration testing report of regular web application, it can be maybe like 50 or 100 pages of report for SAST. 2:20 It can be at least 100 pages of report for basic application because 2:30 Some things are inside the admin panel. 2:33 Some things are maybe inside that Docker. 2:39 Some things are inside the Kubernetes. 2:46 And you can find vulnerabilities in those items. 2:50 So how AI can analyze that stuff and how AI can find those vulnerabilities. 2:58 So AI knows. 3:01 AI knows all the patterns usually, and based on those patterns, it can analyze the code and find the vulnerabilities, right? 3:11 But on top of the regular patterns matching, AI can find also logical vulnerabilities. 3:20 So just to be clear, regular SAST applications, they usually cannot find vulnerabilities on the logic. 3:33 So logical vulnerabilities are usually skipped by scanner because logical vulnerabilities cannot be found by web scanner usually. 3:44 Cannot be fine by static analysis. 3:46 So let's imagine that your application is a bank application. 3:51 And that bank application is providing you with the ability to transfer funds from one account to another account. 4:02 Web scanner can do and what static analyzer can do. 4:07 They both can analyze the source code and try to find common web vulnerabilities like SQL injection, XSS, or some potential issues with remote command execution or CSRF. 4:23 So they are limited to amount of models which they have. 4:28 But in the 4:30 A bank application, one person is sending money to another person. 4:35 And there is no way that SaaS can understand it. 4:39 So static application cannot understand the logic. 4:42 It doesn't get to understand the deep... 4:51 Business behind that application. 4:54 So, for example, if you exchange currency on your website, right? 4:59 So maybe like four or five months ago, we were doing penetration testing for the bank application where one of guys found very interesting vulnerability. 5:10 He was able to exchange one currency on another currency. 5:16 And from the second currency, he was able to exchange on third currency. 5:22 And from the third currency, he was buying the first currency. 5:25 And he was profiting with that simple cycle of exchanges. 5:31 So for some reason, the gap between exchanges was wrong. 5:38 So how SAS can understand it, the static analysis? 5:42 It cannot. 5:43 How web scanner can understand it? 5:45 It cannot. 5:47 AI can understand this because AI can create the logical connections. 5:55 Static analyzer cannot create logical connections. 5:58 They just analyze. 6:01 like one file or multiple files or interconnected files, but it cannot understand what this application is doing. 6:10 Without AI, that feature was not available.