Developer-focused context-aware application security platform

1. A computer-implemented method for providing a context-aware code security solution within a continuous integration and continuous deployment (CI/CD) pipeline, the method comprising:

receiving a set of security vulnerabilities generated by a set of security tools incorporated with the CI/CD pipeline, wherein the set of security vulnerabilities comprises one or more vulnerabilities indicated by the set of security tools at a respective stage of a plurality of stages of the CI/CD pipeline;

receiving, for the plurality of stages of the CI/CD pipeline, contextual data associated with the set of security vulnerabilities from a set of DevOps tools used by the CI/CD pipeline, wherein the contextual data comprises ownership information identifying an entity responsible for fixing a respective security vulnerability in the set of security vulnerabilities;

augmenting the set of security vulnerabilities with the contextual data; and

prioritizing the augmented security vulnerabilities to identify a subset of high-priority vulnerabilities within the set of security vulnerabilities.

2. The computer-implemented method of claim 1 , wherein the contextual data further comprises one or more of the following context types:

an environmental context; and

a business context.

3. The computer-implemented method of claim 2 , wherein the environmental context further includes:

a pre-production environment; and

a post-production environment.

4. The computer-implemented method of claim 2 , wherein augmenting the set of security vulnerabilities with the contextual data comprises providing the environmental context to a respective vulnerability of the set of security vulnerabilities indicating whether the vulnerability is associated with the pre-production environment or the post-production environment.

5. The computer-implemented method of claim 1 , where the entity responsible for fixing the security vulnerability includes a developer or a developer team.

6. The computer-implemented method of claim 5 , wherein the security vulnerability is associated with a software asset owned by the specified developer or the developer team.

7. The computer-implemented method of claim 6 , wherein the software asset is one of the following:

a service;

an application;

a website;

a container;

a virtual machine;

a code repository;

a code directory;

an image repository;

a container image;

a group;

a host; and

an AWS environment such as a load balancers or a virtual firewall.

8. The computer-implemented method of claim 1 , further comprising:

including one or more metadata tags extracted from the contextual data into a corresponding augmented security vulnerability in the augmented security vulnerabilities; and

applying a set of priority rules to the one or more metadata tags to determine a priority associated with the augmented security vulnerability.

9. The computer-implemented method of claim 8 , wherein applying a first priority rule in the set of priority rules comprises:

determining whether an asset associated with the augmented security vulnerability is internet-exposed by processing the one or more metadata tags; and

in response to the asset being internet-exposed, assigning a high priority to the augmented security vulnerability.

10. The computer-implemented method of claim 8 , wherein applying a second priority rule in the set of priority rules comprises:

determining whether an asset associated with the augmented security vulnerability is targeted by an exploit code by processing the one or more metadata tags;

in response to the asset being targeted by the exploit code, assigning a high priority to the augmented security vulnerability; and

in response to the asset not being targeted by any exploit code, assigning a low priority to the augmented security vulnerability.

11. The computer-implemented method of claim 8 , further comprising combining the one or more metadata tags and a criticality level of the the augmented security vulnerability.

12. The computer-implemented method of claim 1 , further comprising:

determining a group of entities responsible for fixing the subset of high-priority vulnerabilities based on the augmented security vulnerabilities; and

notifying the group of entities regarding the subset of high-priority vulnerabilities.

13. The computer-implemented method of claim 12 , wherein notifying the group of entities further comprises automatically generating actionable instructions to fix the subset of high-priority vulnerabilities in an automatically generated order.

14. The computer-implemented method of claim 1 , further comprising displaying the identified subset of high-priority vulnerabilities on a display device capable of displaying, searching, and querying.

15. An apparatus for providing a context-aware code security solution, comprising:

one or more processors; and

a memory coupled to the one or more processors, wherein the memory storing instructions that, when executed by the one or more processors, cause the apparatus to:

receive a set of security vulnerabilities generated by a set of security tools incorporated with a continuous integration and continuous deployment (CI/CD) pipeline, wherein the set of security vulnerabilities comprises one or more vulnerabilities indicated by the set of security tools at a respective stage of a plurality of stages of the CI/CD pipeline;

receive, for the plurality of stages of the CI/CD pipeline, contextual data associated with the set of security vulnerabilities from a set of DevOps tools used by the CI/CD pipeline, wherein the contextual data comprises ownership information identifying an entity responsible for fixing a respective security vulnerability in the set of security vulnerabilities;

augment the set of security vulnerabilities with the contextual data; and

prioritize the augmented security vulnerabilities to identify a subset of high-priority vulnerabilities within the set of security vulnerabilities.

16. The apparatus of claim 15 , wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

include one or more metadata tags extracted from the contextual data into a corresponding augmented security vulnerability in the augmented security vulnerabilities;

apply a set of priority rules to the one or more metadata tags associated with the augmented security vulnerability.

17. The apparatus of claim 15 , wherein the memory further stores instructions that, when executed by the one or more processors, cause the apparatus to:

determine a group of entities responsible for fixing the subset of high-priority vulnerabilities based on the augmented security vulnerabilities; and

notify the group of entities regarding the subset of high-priority vulnerabilities.

18. The apparatus of claim 15 , wherein the contextual data further comprises one or more of the following context types:

an environmental context; and

a business context.

19. A continuous integration and continuous deployment (CI/CD) pipeline integrated with a context-aware security platform, comprising:

a pre-production environment including at least a build and test stage for generating a piece of executable code of an asset;

a post-production environment including at least a cloud server for deploying the piece of executable code of the asset;

a set of security scanners configured to scan the piece of executable code in the pre-production environment and the post-production environment; and

a context-aware code security platform configured to:

receive a set of security vulnerabilities generated by the set of security scanners, wherein the set of security vulnerabilities comprises one or more vulnerabilities indicated by the set of security scanners at a respective stage of a plurality of stages of the CI/CD pipeline;

receive, for the plurality of stages of the CI/CD pipeline, contextual data associated with the set of security vulnerabilities from the pre-production environment and the post-production environment, wherein the contextual data comprises ownership information identifying an entity responsible for fixing a respective security vulnerability in the set of security vulnerabilities;

augment the set of security vulnerabilities with the contextual data; and

prioritize the augmented security vulnerabilities to identify a subset of high-priority vulnerabilities within the set of security vulnerabilities.

20. The CI/CD pipeline of claim 19 , wherein the context-aware code security platform is further configured to:

include one or more metadata tags extracted from the contextual data into a corresponding augmented security vulnerability; and

apply a set of priority rules to the one or more metadata tags associated with the augmented security vulnerability.