System and method for defense in depth of one or more software delivery pipelines

1 . A computer-implemented system for defense in depth, which employs a feedforward orchestrator, of at least one software delivery pipeline, the system comprising:

one or more processors;

a memory;

a continuous integration and continuous deployment pipeline comprising a plurality of stages;

a security context for each stage of the continuous integration and continuous deployment pipeline; and

the feedforward orchestrator stored in the memory and executed by the one or more processors, being configured to analyze the security context for each stage of the continuous integration and continuous deployment pipeline;

wherein the feedforward orchestrator, following its analysis of the security context for each stage of the continuous integration and continuous deployment pipeline, mitigates security vulnerabilities and implements additional security controls with at least one feedforward technique.

2 . The system as claimed in claim 1 , wherein the at least one feedforward technique further comprises at least one vulnerability evaluation and at least one runtime application security measure.

3 . The system as claimed in claim 1 , wherein the at least one feedforward technique further comprises generating a layer of security controls in the at least one software delivery pipeline.

4 . The system as claimed in claim 1 , wherein the feedforward orchestrator employs feedback from at least one security scan and informs subsequent security contexts of the continuous integration and continuous deployment pipeline.

5 . The system as claimed in claim 1 , wherein the feedforward orchestrator is in communication with an application vulnerability correlation platform, a vulnerability exploitability exchange, and an application security posture score module.

6 . A computer-implemented system for defense in depth, which employs a feedforward orchestrator, of at least one software delivery pipeline, the system comprising:

one or more processors;

a memory;

the at least one software delivery pipeline stored in the memory and comprising

a static application security testing module executable by one or more processors;

a dynamic application security testing module executable by the one or more processors;

a security context from each of the static application security testing module and the dynamic application security testing module; and

at least one security scan module executable by the one or more processors and configured to communicate security scan information based on the security context from each of the static application security testing module and the dynamic application security testing module;

wherein the feedforward orchestrator, executable by the one or more processors, is configured to:

analyze the security context from each of the static application security testing module and the dynamic application security testing module and implement at least one security control, wherein the at least one security control comprising a software bill of materials generator and a policy generator;

wherein the feedforward orchestrator continuously employs feedback of the at least one security scan module and the at least one security control to inform subsequent stages or layers of integration and deployment functions of the at least one software delivery pipeline.

7 . The system as claimed in claim 6 , wherein the software bill of materials generator comprises an annotator, an exploit prediction scoring system, known exploited vulnerabilities, a national vulnerability database, and a plurality of graphs.

8 . The system as claimed in claim 6 , wherein the policy generator comprises a runtime application security protection module, an IP whitelisting module, and web firewall rules.

9 . The system as claimed in claim 6 , wherein the feedforward orchestrator employs feedback of the at least one security scan module and the at least one security control for generating additional security controls.

10 . The system as claimed in claim 9 , wherein the additional security controls further comprise at least one layer of security controls placed in the at least one software delivery pipeline.

11 . A method for defense in depth, which employs a feedforward orchestrator, of at least one software delivery pipeline, the method comprising:

initiating an application that includes at least one feedforward module;

starting security scans and tests in the at least one software delivery pipeline;

sending security information from the at least one software delivery pipeline to the feedforward orchestrator;

scanning a security stage of the at least one software delivery pipeline for system security issues;

creating a security context of the security stage;

analyzing the security context of the security stage;

generating security controls to mitigate vulnerabilities obtained from analyzing the security context of the security stage; and

implementing analysis of the security context in a subsequent stage of the at least one software delivery pipeline through the at least one feedforward technique.