Combining static and dynamic testing for improved security

Sammanfattning

This thesis has been done in collaboration between Siyabend Revend, Luleå’s University of Technology and the fin-tech company Scila. Scila’s proposal for this thesis was to improve their continuous environment in terms of static and dynamic tests. Using different testing tools and techniques to improve the quality of code and minimize security threats is one way to assure that your code stays clean and secure. With so many tools to use, which tools should be used and what different vulnerabilities can be detected? In addition, during which stage/stages would it be more beneficial to test your application? This thesis explores a few security testing tools and techniques that have been implemented into a configured GitLab continuous integration (CI) pipeline. The purpose is to improve the security of Scila’s source code by detecting different security threats and bug smells, with automated application security testing. The result that was achieved from the Static Application Security Testing was a success. The DAST implementation remains incomplete due to a few technical barriers and the short amount of time that this thesis was based on.