Dynamic Application Security Testing
Requirements, acceptable baseline criteria, and prerequisites for DAST scans as part of Game Warden's security screening process.
Dynamic Application Security Testing (DAST) is the process of analyzing a web application through the front-end to find vulnerabilities through simulated attacks. Game Warden conducts DAST as part of the routine security screening of your application.
DAST artifacts requirement
As part of the security screening, Second Front (2F) performs and includes DAST artifacts in your application's Authorization Package. These artifacts are critical to provide government accrediting officials with evidence needed to assess and approve your application.
The following cases require DAST artifacts:
- Initial Software Approval: Your application has not yet received a Software Approval.
- Renewal Software Approval: Your application is undergoing Software Approval renewal.
- Significant change: Major updates since the last Software Approval will require reauthorization and a new Software Approval approved by the government accrediting official.
- Ad-hoc requests: To meet continuous monitoring requirements.
DAST Acceptable Baseline Criteria
2F uses a "Meets / Does Not Meet" framework for DAST evaluations:
-
Meets:
- Zero Critical/High security-related findings mapped to CWE/OWASP in the final report (except confirmed false positives).
- All Medium/Low security-related findings mapped to CWE/OWASP include justifications, mitigations, and remediation timelines.
-
Does Not Meet:
- Any Critical/High security-related findings mapped to CWE/OWASP not remediated or documented as a false positive.
- Any Medium/Low security-related findings mapped to CWE/OWASP missing a justification, mitigation, or remediation timeline.
DAST Acceptance Baseline Criteria severity table
| Severity | Requirement | Remediation Timeline |
|---|---|---|
| Critical & High | Zero findings: you must remediate all Critical and High findings or documented as confirmed false positives before generating the final DAST artifact for submission. | Before DAST artifact submission. |
| Medium | Include justification, mitigation, and a remediation timeline plan. | Within 90 days of the scan date. |
| Low | Include justification, mitigation, and a remediation timeline plan. | Within 180 days of the scan date. |
Authenticated scan prerequisites
For DOW deployments, if your application does not automatically grant Keycloak users access to your DEV endpoint, provision a standard test account for Second Front:
- Email format:
{company}-test@secondfront.com(for example,acme-test@secondfront.com) - Permissions: basic/user-level access only (no admin or elevated roles)
This account must be able to sign in and exercise core application functionality needed for DAST without administrative privileges.
Scan prioritization and timeline
Game Warden runs an authenticated scan against the application in a production-like environment, typically the staging environment.