# Interactive Application Security Testing - experiences?

**URL:** <https://club.ministryoftesting.com/t/interactive-application-security-testing-experiences/593>\
**Category:** Archive\
**Tags:** security\
**Created:** [13 April 2017 08:49 UTC](https://club.ministryoftesting.com/t/interactive-application-security-testing-experiences/593 "2017-04-13T08:49:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jogi](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/jogi/32/8189_2.png) [@jogi](https://club.ministryoftesting.com/u/jogi)\
**Post date:** [13 April 2017 08:49 UTC](https://club.ministryoftesting.com/t/interactive-application-security-testing-experiences/593/1 "2017-04-13T08:49:47Z")

</div>

At EuroStar 2016 I visited a track about IAST (Interactive Application Security Testing) and it was really amazing to see that there is a “new” technique (based on a feature since Java 1.5 🙂) that could destroy DAST (dynamic app sec test - hey, you know the scanners which only find ~1/3 of real defect areas) and SAST (static analysis sec test - FindSecBugs, Fortify, SonarType & Co.).

Anybody here wo has experience in the wild with it?

Thank you in advance!  
Jogi

---

<div class="post-metadata">

**Author:** ![jogi](https://sea2.discourse-cdn.com/flex020/user_avatar/club.ministryoftesting.com/jogi/32/8189_2.png) [@jogi](https://club.ministryoftesting.com/u/jogi)\
**Post date:** [22 July 2017 12:50 UTC](https://club.ministryoftesting.com/t/interactive-application-security-testing-experiences/593/3 "2017-07-22T12:50:39Z")

</div>

Hi!

Thanks for your feedback. In the meanwhile I was able to do a proof of concept where I tested twi IAST solutions. It was very easy in both tools to set them up. Include a .jar in the starting routine, run your tests and get impressed by the results. We found security issues we never seen before.

From my experiences:

IAST will change the security testing task from a task to an ongoing monitoring task which also could be done by DevOps/Operations. Integrating the IAST tool into existing defect reporting tools, like Jira and chat channels, like slack, will bring security into the game of a daily task instead of doing “security tests at the end because it needs to be done”.

Also I have learned that there is a solution to have ZERO (!) false positives!

Look for the OWASP Security Benchmark and see that all our activities in web applications have really a problem: We only find \<30% of the issues and often we have many, many false positives, especially in the static code analysis area (SAST tools) which meets my experiences.

IAST is really a good thing for security testing.

Yours,  
Jogi