-1

What are the subtle differences in both - as one could say that both are almost the same...

Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as white-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL).

https://owasp.org/www-community/controls/Static_Code_Analysis

Improve this question
2

1 Answer 1

Reset to default
0

Security Static Code Analysis is a form of SAST (Static Application Security Testing). It covers all methods of analyzing source code for security weaknesses and vulnerabilities. This includes manual as well as automated methods. It is called static analysis to distinguish it from DAST (Dynamic Application Security Testing), where the tests are performed against the running application itself.

Security Code Review is a form of Security Static Code Analysis, but usually excludes purely automated approaches. You talk about a code review if one or more security analysts go through the code and review it. Often, some form of automation is used to make the review more efficient.

Improve this answer
2
  • 1
    The OWASP guide on Code Review states that code review is a mix of automated and manual processes.
    – schroeder ♦
    Apr 13, 2020 at 21:20
  • @schroeder - true, excluding all automation was too strictly worded. Code reviews can benefit from tool support. I clarified this in my answer.
    – Demento
    Apr 13, 2020 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .