Systems and methods for a sanitized code scanning report
A method, computer program product, and computer system for receiving, by a computing device, an indication that a software component is to be released for delivery to a customer. A predefined and non-modifiable industry-standard security profile may be selected defining one or more security scans to be executed in accordance with at least one of an application-security framework and a secure-development standard. The one or more security scans may be executed against the software component using the predefined and non-modifiable industry-standard security profile to identify one or more vulnerabilities. It may be determined that the one or more vulnerabilities that exceeds a remediation threshold has been remediated. A certification report may be generated that includes a sanitized summary of the one or more security-scans results that omits source code, configuration data, and raw vulnerability details from results of the one or more security scan in response to determining that the one or more vulnerabilities that exceeds the remediation threshold has been remediated. The certification report with the sanitized summary may be transmitted to the customer to evidence compliance of the software component with the predefined industry-standard security profile.
1 . A computer-implemented method, comprising:
receiving, by a computing device, an indication that a software component is to be released for delivery to a customer;
selecting a predefined and non-modifiable industry-standard security profile defining one or more security scans to be executed in accordance with at least one of an application-security framework and a secure-development standard;
executing the one or more security scans against the software component using the predefined and non-modifiable industry-standard security profile to identify one or more vulnerabilities;
determining that the one or more vulnerabilities that exceeds a remediation threshold has been remediated;
generating, by applying a sanitization operation to a result of the one or more security scans to exclude at least one of source code, configuration data, and raw vulnerability details from inclusion, a certification report that includes a sanitized summary of the result of the one or more security-scans that omits the source code, the configuration data, and the raw vulnerability details from results of the one or more security scan in response to determining that the one or more vulnerabilities that exceeds the remediation threshold has been remediated; and
transmitting the certification report with the sanitized summary to the customer to evidence compliance of the software component with the predefined industry-standard security profile.
2 . The method of claim 1 , wherein the predefined industry-standard security profile is based on at least one of Open Web Application Security Project (OWASP) framework and National Institute of Standards and Technology (NIST) Secure Software Development Framework (SSDF).
3 . The method of claim 1 , further comprising aggregating, in the certification report, a count of vulnerabilities grouped by severity level.
4 . The method of claim 1 , further comprising digitally signing the certification report using a cryptographic key to authenticate origin and integrity of the certification report.
5 . The method of claim 1 , wherein executing the one or more security scans comprises invoking a third-party Application Security Posture Management (ASPM) service that enforces the industry-standard security profile.
6 . The method of claim 1 , further comprising preventing modification of scan depth, rule selection, and severity thresholds of the one or more security scans.
7 . The method of claim 1 , further comprising performing repeated scans of the software component until all vulnerabilities of the one or more vulnerabilities exceeding the remediation threshold are eliminated prior to enabling generation of the certification report.
8 . The method of claim 1 , further comprising formatting the certification report as an independent vendor-attestation letter identifying a scanning vendor, the secure-development standard, and a timestamp of completion.
9 . The method of claim 1 , further comprising storing the certification report in an immutable ledger to prevent alteration.
10 . The method of claim 1 , wherein generating the certification report includes generating the certification report automatically based upon successful completion of a build stage in a continuous integration/continuous delivery (CI/CD) pipeline.
11 . The method of claim 1 , further comprising receiving a contractual requirement from the customer specifying that delivery of the software component is contingent upon receipt of the certification report.
12 . The method of claim 1 , wherein executing the one or more security scans includes performing the one or more security scans using one of static application security testing (SAST), dynamic application security testing (DAST), and software composition analysis (SCA) techniques.
13 . The method of claim 1 , further comprising associating each certification report with a unique software bill of materials (SBOM) for each corresponding software component.
14 . The method of claim 1 , further comprising scheduling periodic rescans of previously certified software components at defined intervals to maintain compliance.
15 . The method of claim 1 , further comprising operating as a third-party certification service accessible to multiple independent software vendors.
16 . The method of claim 1 , further comprising automatically importing the industry-standard security profiles from one of a network source hosting current OWASP and NIST control definitions.
17 . The method of claim 1 , wherein generating the certification report includes outputting a compliance score based on aggregate vulnerability severity and remediation completeness.
18 . The method of claim 1 , further comprising enforcing the execution of the one or more security scans before permitting deployment of the software component to a production environment.
19 . A computer program product residing on a computer readable storage medium having a plurality of instructions stored thereon which, when executed across one or more processors, causes at least a portion of the one or more processors to perform operations comprising:
receiving, by a computing device, an indication that a software component is to be released for delivery to a customer;
selecting a predefined and non-modifiable industry-standard security profile defining one or more security scans to be executed in accordance with at least one of an application-security framework and a secure-development standard;
executing the one or more security scans against the software component using the predefined and non-modifiable industry-standard security profile to identify one or more vulnerabilities;
determining that the one or more vulnerabilities that exceeds a remediation threshold has been remediated;
generating, by applying a sanitization operation to a result of the one or more security scans to exclude at least one of source code, configuration data, and raw vulnerability details from inclusion, a certification report that includes a sanitized summary of a result of the one or more security-scans that omits source code, configuration data, and raw vulnerability details from results of the one or more security scan in response to determining that the one or more vulnerabilities that exceeds the remediation threshold has been remediated; and
transmitting the certification report with the sanitized summary to the customer to evidence compliance of the software component with the predefined industry-standard security profile.
20 . A computing system including one or more processors and one or more memories configured to perform operations comprising:
receiving, by a computing device, an indication that a software component is to be released for delivery to a customer;
selecting a predefined and non-modifiable industry-standard security profile defining one or more security scans to be executed in accordance with at least one of an application-security framework and a secure-development standard;
executing the one or more security scans against the software component using the predefined and non-modifiable industry-standard security profile to identify one or more vulnerabilities;
determining that the one or more vulnerabilities that exceeds a remediation threshold has been remediated;
generating, by applying a sanitization operation to a result of the one or more security scans to exclude at least one of source code, configuration data, and raw vulnerability details from inclusion, a certification report that includes a sanitized summary of a result of the one or more security-scans that omits source code, configuration data, and raw vulnerability details from results of the one or more security scan in response to determining that the one or more vulnerabilities that exceeds the remediation threshold has been remediated; and
transmitting the certification report with the sanitized summary to the customer to evidence compliance of the software component with the predefined industry-standard security profile.