Contrast for developers
Contrast for developers
The Contrast platform
Your first step is understanding the technologies in the Contrast platform so you can choose an appropriate analysis strategy.
Contrast Scan
Contrast Scan is a static application security testing (SAST) tool that lets you quickly scan code to identify vulnerabilities in early stages of development.
Why use Contrast Scan?
Contrast Scan provides exceptional speed without sacrificing accuracy. It takes just a few minutes and clicks to start a scan. In addition, you can use a local scan engine to avoid uploading your content to the Contrast platform directly. Contrast Scan is a good choice for client-side code such as Angular, React, or Vue.js based applications.
Contrast SCA
Contrast has always provided runtime Software Composition Analysis (SCA) capability with Assess, but now, you can also use Contrast SCA to detect vulnerabilities in your 3rd-party dependencies (mostly open source) statically using a command-line interface (CLI) and through our GitHub integrations, which allow bulk onboarding of projects to Contrast
Why use Contrast for SCA instead of other good (and often free or inexpensive) SCA tools?
Contrast SCA lets you focus only on what matters. Contrast runtime SCA provides a unique ability to not only tell if your application dependency manifests specify a vulnerable version of a vulnerable library but it can tell you which libraries are actually invoked, and to what degree, at runtime. This ability lets you lower the priority on the 70% that aren’t invoked at runtime. Contrast SCA can also detect libraries that are not listed in the manifests but injected at runtime by the environment -- a blindspot for pure static SCA solutions like most free ones.
Contrast Assess
Contrast Assess is the interactive application security testing (IAST) part of the Contrast platform. The core of an IAST tool is sensor modules, software libraries included in the application code. These sensor modules keep track of application behavior while the interactive tests are running. IAST analyzes code in runtime to find vulnerabilities, like static application security testing (SAST) tools do prior to compile and execution. It analyzes runtime behavior, like dynamic application security testing (DAST) tools. It also serves as the collector for our runtime Software Composition Analysis (SCA) capability. So, you can think of Contrast Assess as four tools in one.
Why use Contrast Assess?
Assess has a fraction of the false positives while finding up to twice the true positives as other SAST tools, without adding any additional scan wait times for both SAST and DAST tools. That’s because with Contrast Assess, each interaction of the application by a user or your automated QA tests raises valuable telemetry about the security of the code in operation. This information makes IAST the simplest and least intrusive security process to add earlier in the development cycle, since no changes to your process are needed and will add no delays to your release schedule
Contrast Protect
Contrast Protect, is a runtime application self-protection (RASP) tool. Using the same technology as Assess, it blocks traffic that would have resulted in a successful attack.
Why should you integrate Protect into builds that you deploy to production?
Contrast Protect provides negative-day protection for zero-day attacks. The three-year-old version of Protect was able to block the infamous Log4Shell remote code execution attacks. For actively developed applications, this gives you time to upgrade, avoiding the late-night rush when a new zero-day emerges.
For maintenance-mode applications, it might serve as a long-term protection allowing you to stay focused on new applications. It also provides developers with actionable threat intelligence because it not only tells you attacks are occurring (information you may or may not be getting from your security team) but it also shows you the code paths used by the blocked attackers so you can easily eliminate them.