Adaptive selection of security scanning in software deployments
Systems and methods for adaptive selection of security scanning in software deployments are disclosed. An embodiment of the present invention is directed to dynamically modifying scope based on specific code changes, third party risks and/or architectural changes. By selectively prioritizing and sequencing the scans, an embodiment of the present invention integrates language framework, third-party risks and design changes into a unified security scan workflow that optimizes efficiency while maintaining strong robust coverage.
1 . A computer-implemented system comprising:
a computer server comprising one or more processors;
a memory component that stores and manages software development data; and
non-transitory memory comprising instructions that, when executed by the one or more processors, cause the one or more processors to:
initiate, via a software development pipeline, an update in a software application during a software development cycle;
detect, via a change evaluation processor, a change in the software application between the update and a prior version wherein the change is assigned a corresponding change type;
perform, via a contextual awareness processor, a contextual analysis for the detected change based on a potential impact of the change on the software application;
determine, via a risk assessment processor, a risk assessment based on the contextual analysis for the detected change;
generate, via a demand generator, a scan demand plan that comprises a set of scan tools from a pool of scan tools, comprising at least two scan tools, in a predetermined order to adaptively address the risk assessment, wherein the scan demand plan is based at least in part on resource optimization and comprises a dynamic chain of scan tools where each scan tool in the predetermined order is conditionally triggered based on results of a preceding scan tool, and wherein an output of a first scan tool is used to narrow or focus tasks for a subsequent scan tool;
apply, via an integration interface, the set of scan tools according to the predetermined order wherein the integration interface receives the scan demand plan from the demand generator and initiates and activates the set of scan tools;
receive, via a communication network, a set of results from each of the set of scan tools;
correlate the set of results in a manner that generates a composite result of vulnerabilities;
provide, via a communication network, the composite result of vulnerabilities; and
based upon the composite result of vulnerabilities, automating a response thereto comprising implementing a set of actions to address the vulnerabilities.
2 . The computer-implemented system of claim 1 , wherein the corresponding change type comprises one of: code change, design change, technology stack change, deployment change and configuration change.
3 . The computer-implemented system of claim 1 , wherein the contextual analysis is configurable to a specific entity.
4 . The computer-implemented system of claim 1 , wherein the contextual analysis is based on one or more rankings comprising: application asset ranking, infrastructure ranking, and business key services ranking.
5 . The computer-implemented system of claim 1 , wherein the risk assessment is based on security risk.
6 . The computer-implemented system of claim 1 , wherein the pool of scan tools comprises a plurality of tools that perform: static application security testing, dynamic application security testing, mobile application security testing, API scanning, design validation, penetration testing and logging.
7 . The computer-implemented system of claim 1 , wherein the pool of scan tools is configurable and specific to an entity.
8 . The computer-implemented system of claim 1 , wherein the change is detected at a PR stage or at a release stage within a continuous integration/continuous development pipeline.
9 . A computer-implemented method, comprising the steps of:
initiating, via a software development pipeline, an update in a software application during a software development cycle;
detecting, via a change evaluation processor, a change in the software application between the update and a prior version wherein the change is assigned a corresponding change type;
performing, via a contextual awareness processor, a contextual analysis for the detected change based on a potential impact of the change on the software application;
determining, via a risk assessment processor, a risk assessment based on the contextual analysis for the detected change;
generating, via a demand generator, a scan demand plan that comprises a set of scan tools from a pool of scan tools, comprising at least two scan tools, in a predetermined order to adaptively address the risk assessment, wherein the scan demand plan is based at least in part on resource optimization and comprises a dynamic chain of scan tools where each scan tool in the predetermined order is conditionally triggered based on results of a preceding scan tool, and wherein an output of a first scan tool is used to narrow or focus tasks for a subsequent scan tool;
applying, via an integration interface, the set of scan tools according to the predetermined order wherein the integration interface receives the scan demand plan from the demand generator and initiates and activates the set of scan tools;
receiving, via a communication network, a set of results from each of the set of scan tools;
correlating the set of results in a manner that generates a composite result of vulnerabilities;
providing, via a communication network, the composite result of vulnerabilities; and
based upon the composite result of vulnerabilities, automating a response thereto comprising implementing a set of actions to address the vulnerabilities.
10 . The computer-implemented method of claim 9 , wherein the corresponding change type comprises one of: code change, design change, technology stack change, deployment change and configuration change.
11 . The computer-implemented method of claim 9 , wherein the contextual analysis is configurable to a specific entity.
12 . The computer-implemented method of claim 9 , wherein the contextual analysis is based on one or more rankings comprising: application asset ranking, infrastructure ranking, and business key services ranking.
13 . The computer-implemented method of claim 9 , wherein the risk assessment is based on security risk.
14 . The computer-implemented method of claim 9 , wherein the pool of scan tools comprises a plurality of tools that perform: static application security testing, dynamic application security testing, mobile application security testing, API scanning, design validation, penetration testing and logging.
15 . The computer-implemented method of claim 9 , wherein the pool of scan tools is configurable and specific to an entity.
16 . The computer-implemented method of claim 9 , wherein the change is detected at a PR stage or at a release stage within a continuous integration/continuous development pipeline.