Do these 2 terminologies refer to the same thing? https://www.owasp.org/index.php/Source_Code_Analysis_Tools


Some of the tools overlap. Makes you wonder. If they are different can someone explain to me the differences.

  • In this case, they are the same. The OWASP link is defining and listing SAST tools. – Xander Aug 13 '14 at 0:33

Often, people use these interchangeably within the security industry.

The lists you are pointing to are referring to the same types of tools/assessment, with the addition that the second list is broader, including static analysis tools that are not targeted at security, such as those used to check for code quality issues.

Some types of SAST technically do not review source, but binaries, so it can be a little bit of a misnomer to call it SCA, in that situation.

I personally like the DAST, SAST, MAST nomenclature, because it delineates between the broad types of assessing applications for security issues: by running tests against a running application (dynamic analysis), by examining the code components or a model of them (static analysis), or by tool-assisted expert inspection and testing (manual analysis).


In a popular book on the topic, "The Art of Software Security Assessment", strategies for code audits (Chapter 4) stem from three major concepts:

  1. Code comprehension strategies, e.g. your "source code analysis" where code is read from top to bottom, in pieces/components, or because of runtime hit traces in the execution flow cover particular areas of interest such as methods, functions, or basic blocks
  2. Candidate point strategies, e.g., your "static application security testing" where code is analyzed with an automated tool -- typically lexical analyzers, dynamic application security testing scanners, integrated application security testing frameworks, and/or AST-parsing modeling checkers. Note that all of these tools must be driven by a domain-level expert in order to be understood and tuned
  3. Design generalization strategies, partly rooted in source code analysis, but the code, or its underlying architecture, is analyzed by a method (e.g., OOA&D) and/or tool (e.g., doxygen, ctags, etc) -- typically to uncover Software Patterns, frameworks, components, and, if object-oriented, mappings of class diagarms. Note that these methods and tools must be driven again by a domain-level expert for proper interpretation and optimization

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.