66
Cybersecurity Guidelines for Digital Financial Asset Trading Providers in Indonesia
2. Dynamic Application Security Testing (DAST) DAST is a testing approach applied to applications in their running state, simulating external interactions similar to those of users or attackers (black-box testing). DAST is useful for: a. Identifying security gaps that arise from real interactions between applications and their operational environment, b. Finding vulnerabilities not detected by SAST, such as weak runtime configurations, session management errors, or vulnerable endpoints, c. Reducing false positives, as it only highlights vulnerabilities that can actually be exploited from the user’s perspective 10 . To increase the effectiveness of this process, SAST and DAST should ideally be integrated into the CI/CD (Continuous Integration/Continuous Deployment) pipeline to support automated detection, continuous monitoring, and rapid correction of security issues. In addition, Providers must: • Implement appropriate secure coding standards , such as OWASP Secure Coding Practices or SEI CERT Coding Standards, • Provide regular training for developers on best practices in secure software development, • Conduct layered code reviews, including peer reviews and independent security audits, • Establish an application vulnerability management policy that includes procedures for prioritizing vulnerabilities, risk assessment, and clear repair timelines.
10 JetBrains TeamCity. (2025). SAST vs DAST: Differences and When to Use.
Made with FlippingBook Ebook Creator