DevSecOps › Module 4 › Lesson 1
SAST Named
SAST named literacy covers static analysis triggers, rule categories, severity tiers, and CI integration — read SAST anatomy on YOUR $DEVSEC_LAB repo before merge gates.
Visual · t36_sast_named
SAST named literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
SAST finds code flaws before runtime — literacy teaches static analysis vocabulary so you wire scanners on repos you govern, not stranger org codebases.
SAST — Static Application Security Testing — analyzes source code and bytecode without executing the app. Tools like CodeQL, Semgrep, and SonarQube flag SQL injection patterns, hardcoded credentials, weak crypto, and dangerous APIs. CI runs SAST on PR diffs on YOUR repo; findings map to severity and CWE IDs for triage. Cyberlium outlines SAST anatomy on YOUR $DEVSEC_LAB — write SAST row for tool class, trigger, severity gate on one fictional repo. Next: Gitleaks Named.
1. SAST components (named)
Trigger: on pull_request and push to main on YOUR repo. Rules: injection, XSS, path traversal, insecure deserialization patterns. Severity: critical/high block merge, medium warn, low informational. Output: SARIF or platform-native findings for triage dashboard.
On $DEVSEC_LAB, write SAST row — tool name, trigger, severity gate for one fictional API repo.
Command guide
Try these commands — SAST components (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: curl, grep. Reference sites: Bridgecrew Checkov (https://www.checkov.io/); Checkov Terraform (https://www.checkov.io/5.Policy%20Index/terraform.html); NIST SSDF PW.4 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why SAST literacy enables shift-left fixes
Runtime DAST misses dead code paths SAST still sees. Developer fixes in PR cost minutes vs production hotfixes. Version-controlled SAST config survives team turnover on lab repos.
Students draft lab SAST notes — production SAST follows org DaC repos and merge policies.
3. Lab boundary
Forbidden: running SAST against stranger org repos without scope. Allowed: SAST named card — skeleton with $DEVSEC_LAB fictional repo and severity gate.
Ship: SAST named card for YOUR lab repo. Next: Gitleaks Named.
4. What you ship: SAST named card for $DEVSEC_LAB
Tool, trigger, severity gate, CWE example. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. SAST named card. $DEVSEC_LAB named. File t36-m04-l01-sast-named.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run SAST on stranger org clone. Ignore critical findings because 'lab code.'
Right
Write SAST named card for YOUR $DEVSEC_LAB. Next: Gitleaks Named.
Mission: draft SAST config on YOUR lab repo
1) Name SAST trigger and output format. 2) Write severity gate policy. 3) List two rule categories. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
SAST runs on YOUR repo — never stranger org code without authorization.
Knowledge Check
APPLY: SAST primarily analyzes:
Multiple choice
Knowledge Check
APPLY: True or False: SAST on Cyberlium runs against YOUR $DEVSEC_LAB repos only.
True or False
Knowledge Check
APPLY: SAST named literacy on Cyberlium uses:
Multiple choice