DevSecOps › Module 4 › Lesson 1
SAST Named
SAST named literacy covers static analysis triggers, rule categories, severity tiers, and CI integration — read SAST anatomy on YOUR $DEVSEC_LAB repo before merge gates.
Visual · t36_sast_named
SAST named literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
SAST finds code flaws before runtime — literacy teaches static analysis vocabulary so you wire scanners on repos you govern, not stranger org codebases.
SAST — Static Application Security Testing — analyzes source code and bytecode without executing the app. Tools like CodeQL, Semgrep, and SonarQube flag SQL injection patterns, hardcoded credentials, weak crypto, and dangerous APIs. CI runs SAST on PR diffs on YOUR repo; findings map to severity and CWE IDs for triage. Cyberlium outlines SAST anatomy on YOUR $DEVSEC_LAB — write SAST row for tool class, trigger, severity gate on one fictional repo. Next: Gitleaks Named.
1. SAST components (named)
Trigger: on pull_request and push to main on YOUR repo. Rules: injection, XSS, path traversal, insecure deserialization patterns. Severity: critical/high block merge, medium warn, low informational. Output: SARIF or platform-native findings for triage dashboard.
On $DEVSEC_LAB, write SAST row — tool name, trigger, severity gate for one fictional API repo.
Command guide
Try these commands — SAST components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Bridgecrew Checkov — https://www.checkov.io/ Checkov Terraform — https://www.checkov.io/5.Policy%20Index/terraform.html NIST SSDF PW.4 — https://csrc.nist.gov/Projects/ssdf
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://www.checkov.io/ | head -10
cat > "$DEVSEC_LAB/notes/checkov-named.txt" <<'EOF'
Checkov — NAMED LITERACY (IaC policy-as-code):
Scans: Terraform, CloudFormation, Kubernetes, Dockerfile, etc.
Command: checkov -d PATH or checkov -f main.tf
Output: PASSED/FAILED checks with CIS/NIST/custom policy IDs
CI: fail build on CRITICAL misconfigs — YOUR main.tf intentional gaps
Lab: write tiny terraform stub with deliberate misconfig — scan YOUR iac/ only
EOFCommand — copy this
grep -E 'checkov|Terraform|YOUR' "$DEVSEC_LAB/notes/checkov-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: Bridgecrew Checkov (https://www.checkov.io/); Checkov Terraform (https://www.checkov.io/5.Policy%20Index/terraform.html); NIST SSDF PW.4 (https://csrc.nist.gov/Projects/ssdf). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why SAST literacy enables shift-left fixes
Runtime DAST misses dead code paths SAST still sees. Developer fixes in PR cost minutes vs production hotfixes. Version-controlled SAST config survives team turnover on lab repos.
Students draft lab SAST notes — production SAST follows org DaC repos and merge policies.
3. Lab boundary
Forbidden: running SAST against stranger org repos without scope. Allowed: SAST named card — skeleton with $DEVSEC_LAB fictional repo and severity gate.
Ship: SAST named card for YOUR lab repo. Next: Gitleaks Named.
4. What you ship: SAST named card for $DEVSEC_LAB
Tool, trigger, severity gate, CWE example. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. SAST named card. $DEVSEC_LAB named. File t36-m04-l01-sast-named.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run SAST on stranger org clone. Ignore critical findings because 'lab code.'
Right
Write SAST named card for YOUR $DEVSEC_LAB. Next: Gitleaks Named.
Mission: draft SAST config on YOUR lab repo
1) Name SAST trigger and output format. 2) Write severity gate policy. 3) List two rule categories. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
SAST runs on YOUR repo — never stranger org code without authorization.
Knowledge Check
APPLY: SAST primarily analyzes:
Multiple choice
Knowledge Check
APPLY: True or False: SAST on Cyberlium runs against YOUR $DEVSEC_LAB repos only.
True or False
Knowledge Check
APPLY: SAST named literacy on Cyberlium uses:
Multiple choice