[Autogenerated] Now let's move on to the coding section off the life cycle.
I want to clarify something that confuses money.
People We have some acronyms s e A or scar on and S A S T or assessed
the's air regularly used at this stage in the life cycle.
But they're two very different activities.
Fast or static.
Application Security testing is something that is a process
that examined source code to identify weaknesses that can
lead to security vulnerabilities.
Think of it as a source cold review and testing off the source code itself
scare or a software composition analysis is quite different.
This is a process that looks at the open source components
that make up your software and checks all of the's components
against known vulnerabilities.
Most software is comprised of some parts that are open source today.
In fact, the volume of open source components and software today is increasing,
so software composition analysis is growing in importance.
The open source elements of your cold are compared against publicly
available vulnerability databases to identify if any of your open source
components have vulnerabilities that need remediation,
this can help avoid problems later on is always good to
get done early in the life cycle.
Let's look at some of the features off.
Sask SAS involves reading source code similar to coding standards.
It's language specific,
so you will have to get a language specific scanner for the
programming language that you were using very often.
There can be false positives presented,
so you will have to factor in time for assessing the findings off assessed scan.
False positives arise because there isn't a whole other
context available for the scanner.
All they have to work with is the role source code SAS can be fast and
automated and integrated into our built pipeline.
It finds weaknesses early in the process,
which reduces overall costs for remediation.
NIST,
the National Institute for Standards and Technology has
published a list of source code security analyzers,
which you can find in the link below.
There is some open source and some commercial products listed