Implement Code>Level Security Checks
Description
Apply static and dynamic analysis tools within the application life cycle to verify that secure coding practices are being followed.
Implementation Checklist
Tool Recommendations
Application security platform with SAST, DAST, SCA, and developer training for secure software development
Veracode · Per-application subscription
Cloud-native application security platform with SAST, SCA, DAST, API security, and supply chain security testing
Checkmarx · Per-developer subscription
Application security testing suite with SAST (Coverity), SCA (Black Duck), and DAST for comprehensive AppSec
Synopsys · Per-developer subscription
Developer-first application security with SCA, container scanning, IaC security, and SAST integrated into CI/CD
Snyk · Per-developer subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Vulnerability Deployed to Production Undetected
IntegrityA cross-site scripting vulnerability is introduced in a code change and deployed to production because no static or dynamic analysis tools are integrated into the CI/CD pipeline to catch it before release.
Hardcoded Secrets Committed to Source Code Repository
ConfidentialityA developer commits API keys and database credentials directly into source code, and they are pushed to a shared repository without detection because no static analysis scans for embedded secrets.
Business Logic Flaw Missed Without Dynamic Testing
ConfidentialityA complex authorization bypass vulnerability exists in a running application but is undetectable through code review alone, and no dynamic analysis tool tests the running application to discover it.
Vulnerabilities (When Safeguard Absent)
No Automated Security Analysis in Development Pipeline
Without SAST and DAST tools integrated into the application lifecycle, security vulnerabilities in code and running applications are not systematically detected before deployment to production.
Manual-Only Code Review for Security
Reliance on manual code review alone without automated static and dynamic analysis tools means coverage is inconsistent and common vulnerability patterns are frequently missed.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |