What are the subtle differences in both - as one could say that both are almost the same...

Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as white-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL).



Security Static Code Analysis is a form of SAST (Static Application Security Testing). It covers all methods of analyzing source code for security weaknesses and vulnerabilities. This includes manual as well as automated methods. It is called static analysis to distinguish it from DAST (Dynamic Application Security Testing), where the tests are performed against the running application itself.

Security Code Review is a form of Security Static Code Analysis, but usually excludes purely automated approaches. You talk about a code review if one or more security analysts go through the code and review it. Often, some form of automation is used to make the review more efficient.

| improve this answer | |
  • 1
    The OWASP guide on Code Review states that code review is a mix of automated and manual processes. – schroeder Apr 13 at 21:20
  • @schroeder - true, excluding all automation was too strictly worded. Code reviews can benefit from tool support. I clarified this in my answer. – Demento Apr 13 at 21:27
  • thank you everyone! – Andrei Clear Apr 17 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.