From the course: Microservices Security Workshop: From Build to Production

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Static application security testing (SAST)

Static application security testing (SAST)

From the course: Microservices Security Workshop: From Build to Production

Start my 1-month free trial Buy for my team

Static application security testing (SAST)

“

- [Instructor] Let's start this section by stepping back for a moment. So far, we've covered architecture authentication, front-end concerns, and secure design patterns. Now we're finally getting to scanning. If you've been in security, you're probably surprised that we've covered so much ground and haven't yet talked about any security scanners. Well, that's because there's an overall problem within the security ecosystem that is a reliance on scanners to do everything for us. So in this lesson, I want to demonstrate what some of the shortcomings of scanners are. Here, I'm going to run a quick Semgrep scan to just see what issues we find. So looking at some of these issues, the main thing that it finds is cores, which we covered earlier, is why it's not a high priority security issue. We've got this user command where our docker files are running as root, which is a serious issue. And then the only code-related finding we have is that we are vulnerable to command injection, which is…

Contents