Abstract: In the modern DevOps (development operations) development model, IAST (interactive application security testing) technology has a significant security effect in the practice of how to embed the security into the R & D test process and how to ensure the security of software R & D in the case of lack of security personnel resources. At the same time, IAST has excellent performance in the vulnerability detection rate and vulnerability false positive rate. IAST can not only solve the general security risks and open source software risks in the process of software R & D, but also find the sensitive and private data leakage problems in Web applications through sensitive data tracking technology. This paper discusses that IAST is a new generation of security testing technology more in line with the concept of DevOps system.

Key words: DevOps, IAST, sensitive data, vulnerability detection rate, vulnerability false positive rate

摘要： 在现代研发运维一体化（development operations，DevOps）开发模型中，在安全如何嵌入研发测试流程以及在安全人员资源缺失的情况下如何保障软件研发安全的实践过程中，交互式应用安全测试（interactive application security testing，IAST）技术有着显著的安全保障效果，同时在漏洞检出率和漏洞误报率方面也有优秀的表现。IAST不仅可以解决软件研发过程中的通用型安全隐患和开源软件风险，还可以通过敏感数据追踪技术发现Web应用存在的敏感及隐私数据泄露问题。从多角度论述了IAST是更符合DevOps体系理念的新一代安全测试技术。

关键词: 研发运维一体化, 交互式应用安全测试, 敏感数据, 漏洞检出率, 漏洞误报率