Systems and methods for software security analysis
A security analysis of software includes analyzing security risks at each level of the hierarchy of the software and aggregating identified risks within the hierarchy levels. Weights applied during aggregation assist in homogenizing risk scores originating from different types of identified security risks and provide for the ability to communicate a meaningful risk score at each level of the hierarchy.
1. A computer-implemented method for analyzing software dependencies, comprising:
on a first asset, executing a technology agent configured to:
analyze software stored in memory of the first asset, the analysis comprising:
identifying nodes within the software,
recording a hierarchy of the nodes within the software,
identifying any dependencies within the software and with other portions of software; and
on the first asset, executing a security agent configured to:
analyze security of the software stored in the memory of the first asset, the security analysis comprising:
identifying security risks in the software and assigning a risk level to each,
associating each identified security risk with a node or edge, and
aggregating security risks at at least two different levels of the software hierarchy into hierarchy level risk scores by first applying weights to the risk levels and then adding the weighted risk levels of identified security risks associated with nodes or edges within the levels,
wherein:
the security analysis further comprises identifying a frequency of modifications made to each of a plurality of nodes, and
a modification frequency weight is applied that increases with a higher frequency of modifications identified for a particular node.
2. The method of claim 1 , wherein identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list.
3. The method of claim 1 , wherein:
identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list, and
a CVE presence weight is applied that increases with a higher number of CVEs identified in nodes or edges within a particular level.
4. The method of claim 1 , wherein:
identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list, and
a CVE frequency weight is applied that increases with a higher frequency of CVEs identified in nodes or edges within a particular level.
5. The method of claim 1 , wherein:
the security analysis further comprises identifying users responsible for modifications made to each of a plurality of nodes, and
a modification diversity weight is applied that increases with a higher number of unique users responsible for modifications to a particular node.
6. The method of claim 1 , wherein:
the security analysis further comprises identifying a number of methods present in each class, and
a method abundance weight is applied that increases with a higher number of methods identified for a particular class.
7. The method of claim 1 , wherein:
the security analysis further comprises identifying, for each application, a privilege level at which the application is running, and
an application privilege weight is applied that increases with application privilege level.
8. The method of claim 1 , wherein the security analysis further comprises aggregating all risk scores for the different hierarchy levels into a single software risk score.
9. The method of claim 8 , wherein the aggregation of hierarchy level risk scores includes applying weights to the hierarchy level risk scores prior to their aggregation.
10. The method of claim 1 , wherein:
the security analysis further comprises identifying, for nodes associated with databases, whether data stored in the associated database is of a sensitive nature, and
a data sensitivity weight is applied that increases for nodes associated with databases storing data of a sensitive nature.
11. A computer-implemented method for analyzing software dependencies, comprising:
on a first asset, executing a technology agent configured to:
analyze software stored in memory of the first asset, the analysis comprising:
identifying nodes within the software,
recording a hierarchy of the nodes within the software,
identifying any dependencies within the software and with other portions of software; and
on the first asset, executing a security agent configured to:
analyze security of the software stored in the memory of the first asset, the security analysis comprising:
identifying security risks in the software, including by identifying dependencies that traverse a DMZ policy and identifying a security risk for each such traversal, and assigning a risk level to each,
associating each identified security risk with a node or edge, and
aggregating security risks at at least two different levels of the software hierarchy into hierarchy level risk scores by adding risk levels of identified security risks associated with nodes or edges within the levels.
12. The method of claim 1 , further comprising detecting when the hierarchy has been modified to include one or more new or changed nodes and, upon detecting such modification, initiating a security analysis of the new or changed nodes and re-security risks of the at least two different levels of the software hierarchy based on the results of the security analysis of the new or changed nodes.
13. The method of claim 11 , wherein identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list.
14. The method of claim 11 , wherein the aggregation of security risks includes applying weights to the risk levels prior to their addition.
15. The method of claim 14 , wherein:
identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list, and
a CVE presence weight is applied that increases with a higher number of CVEs identified in nodes or edges within a particular level.
16. The method of claim 14 , wherein:
identifying security risks in the software includes identifying a security risk if a node appears on a CVE list or contains code appearing on a CVE list, and
a CVE frequency weight is applied that increases with a higher frequency of CVEs identified in nodes or edges within a particular level.
17. The method of claim 14 , wherein:
the security analysis further comprises identifying users responsible for modifications made to each of a plurality of nodes, and
a modification diversity weight is applied that increases with a higher number of unique users responsible for modifications to a particular node.
18. The method of claim 14 , wherein:
the security analysis further comprises identifying a number of methods present in each class, and
a method abundance weight is applied that increases with a higher number of methods identified for a particular class.
19. The method of claim 14 , wherein:
the security analysis further comprises identifying, for each application, a privilege level at which the application is running, and
an application privilege weight is applied that increases with application privilege level.
20. The method of claim 11 , wherein the security analysis further comprises aggregating all risk scores for the different hierarchy levels into a single software risk score.
21. The method of claim 20 , wherein the aggregation of hierarchy level risk scores includes applying weights to the hierarchy level risk scores prior to their aggregation.
22. The method of claim 11 , wherein:
the security analysis further comprises identifying, for nodes associated with databases, whether data stored in the associated database is of a sensitive nature, and
a data sensitivity weight is applied that increases for nodes associated with databases storing data of a sensitive nature.
23. The method of claim 11 , further comprising detecting when the hierarchy has been modified to include one or more new or changed nodes and, upon detecting such modification, initiating a security analysis of the new or changed nodes and re-security risks of the at least two different levels of the software hierarchy based on the results of the security analysis of the new or changed nodes.