Apparatus, system, and method for correlating security vulnerabilities from multiple independent vulnerability assessment methods
The present disclosure relates to methods for correlating security vulnerability assessment data from a network vulnerability assessment, a static application security test (SAST) assessment and/or a zero day vulnerability metadata source.
1. A method comprising:
receiving in computer memory a SAST assessment for a software application;
receiving in computer memory the software application;
instrumenting the software application based on the SAST assessment, wherein instrumenting the software application comprises inserting at least one instruction in the software application;
loading the instrumented software application on a network host;
executing the instrumented software application on the network host, wherein an output from an instrumented portion of the software application is outputted when the instrumented portion of the software application is executed on the network host, wherein the output is entered in a log file on the network host, and wherein the entry in the log file identifies a location of the instrumented portion within the software application;
performing a network vulnerability scan on the network host and creating a network vulnerability assessment based on the results of the network vulnerability scan;
receiving in computer memory at least one output from an instrumented and executed portion of the software application; and
correlating at least one item in the SAST assessment with at least one item in the network vulnerability assessment based on the at least one output by associating a location of the instrumented and executed portion of the software application within the software application, as determined by the at least one output, and a test program performed during the network vulnerability scan.
2. The method of claim 1 , where the location is identified by line number.
3. A non-transitory computer-readable medium comprising instructions, that when executed by a processor, cause the processor to perform the steps comprising:
receiving in computer memory a SAST assessment for a software application;
receiving in computer memory the software application;
instrumenting the software application based on the SAST assessment, wherein instrumenting the software application comprises inserting at least one instruction in the software application;
loading the instrumented software application on a network host;
executing the instrumented software application on the network host, wherein an output from an instrumented portion of the software application is outputted when the instrumented portion of the software application is executed on the network host, wherein the output is entered in a log file on the network host, and wherein the entry in the log file identifies a location of the instrumented portion within the software application;
performing a network vulnerability scan on the network host and creating a network vulnerability assessment based on the results of the network vulnerability scan;
receiving in computer memory at least one output from an instrumented portion of the software application; and
correlating at least one item in the SAST assessment with at least one item in the network vulnerability assessment based on the at least one output by associating a location of the instrumented and executed portion of the software application within the software application, as determined by the at least one output, and a test program performed during the network vulnerability scan.
4. The non-transitory computer-readable medium of claim 3 , where the location is identified by line number.