How to make dynamic testing work for DevOps teams?

‍

One of the challenges with being able to introduce DAST into DevOps, in the same vein that people have been able to introduce SAST, is speed. It's slower.

‍

The expectation when running things like CI pipelines is that the pipeline takes seconds or minutes, but often these DAST tools can take hours or days to run in their default configuration. However, there are ways we can manage this to support our DevOps teams.

‍

First and foremost, is there a cut down version of the DASt that we can run as an initial check to decide whether or not we can pass something on to the next stage of the testing process. If we can feed information from SAST in so we can see that particular vulnerabilities have been potentially detected, then validate these with DAST. We now know that we have a different pool of particular vulnerabilities that won't have been detected as SAST isn't able to do that. With this more concentrated focus, we can run a version of DAST that completes much faster than you may have previously experienced.

‍

The other thing you can do is look at batching things up. As long as you've got a record of what changes have occurred and what's going on outside of your pipeline, then you can start looking at running a DAST tool at a regular cadence. Then, you can feed in the information from those different change management systems, so that it's catching several different changes before they go into production, but not necessarily before they go into staging.