Systems and methods for fixing application vulnerabilities through a correlated remediation approach
The invention relates to a system and method for fixing application vulnerabilities through a correlated remediation approach. This invention involves identifying application vulnerabilities through dynamic and static assessment of an application. The vulnerability instances reported in the static assessment are fixed using standard code fixes. The assessment results obtained from the static and the dynamic assessment are then correlated to identify how many vulnerability instances reported in the static assessment are fixed by the standard code fixes. If a vulnerability instance reported in the dynamic assessment corresponds to more than one vulnerability instance reported in the static assessment then the shortest and most cost effective path to fix the vulnerability instance is determined. These results are stored in a graph database and based on the graph database the application vulnerabilities are fixed. An inference engine can be used to identify the correct fix for an application vulnerability.
1. A method for fixing application vulnerabilities, comprising:
identifying, by a computing device, one or more application vulnerabilities through a first dynamic security assessment and a static security assessment of an application;
fixing, by the computing device, at least one of a first set of vulnerability instances reported in the static security assessment based on a secure coding practice;
running, by the computing device, a plurality of other dynamic security assessments to identify one or more of a second set of vulnerability instances reported in the first dynamic security assessment that have been fixed by the fixing of the at least one of the first set of vulnerability instances reported in the static security assessment;
identifying, by the computing device, one or more of a third set of vulnerability instances reported in the plurality of other dynamic security assessments that correspond to the at least one of the first set of vulnerability instances reported in the static security assessment by correlating one or more results of the plurality of other dynamic security assessments and the static security assessment;
determining, by the computing device, a shortest path to fix the one or more application vulnerabilities when one or more of the third set of vulnerability instances reported in the plurality of other dynamic security assessments correspond to at least one of the first set of vulnerability instances reported in the static security assessment; and
fixing, by the computing device, the one or more application vulnerabilities based on the correlation and the shortest path to fix the one or more application vulnerabilities.
2. The method as claimed in claim 1 , further comprising creating, by the computing device, a database configured to store information related to at least the third set of vulnerability instances reported in the plurality of other dynamic security assessments and the first set of vulnerability instances reported in the static security assessment.
3. The method as claimed in claim 1 , further comprising running, by the computing device, one or more scripts to organize information related to the one or more application vulnerabilities.
4. The method as claimed in claim 1 , wherein one or more results of the correlation are represented in the form of a bipartite graph.
5. The method as claimed in claim 1 , wherein information related to the correlation of the plurality of other dynamic security assessments and the static security assessment and the shortest path to fix the one or more application vulnerabilities is stored in a graph database to facilitate remediation.
6. A computing device comprising a processor and a memory coupled to the processor, wherein the processor is configured to execute programmed instructions stored in the memory to:
identify one or more application vulnerabilities through a first dynamic security assessment and a static security assessment of an application;
fix at least one of a first set of vulnerability instances reported in the static security assessment based on a secure coding practice;
run a plurality of other dynamic security assessments to identify one or more of a second set of vulnerability instances reported in the first dynamic security assessment that have been fixed by the fixing of the at least of the first set of one vulnerability instances reported in the static security assessment;
identify one or more of a third set of vulnerability instances reported in the plurality of other dynamic security assessments that correspond to the at least one of the first set of vulnerability instances reported in the static security assessment by correlating one or more results of the plurality of other dynamic security assessments and the static security assessment;
determine a shortest path to fix the one or more application vulnerabilities when one or more of the third set of vulnerability instances reported in the plurality of other dynamic security assessments correspond to at least one of the first set of vulnerability instances reported in the static security assessment; and
fix the one or more application vulnerabilities based on the correlation and the shortest path to fix the one or more application vulnerabilities.
7. The computing device as claimed in claim 6 , wherein the processor coupled to the memory is further configured to execute at least one additional programmed instruction stored in the memory to: create a database configured to store information related to at least the third set of vulnerability instances reported in the plurality of other dynamic security assessments and the first set of vulnerability instances reported in the static security assessment.
8. The computing device as claimed in claim 6 , wherein the processor coupled to the memory is further configured to execute at least one additional programmed instruction stored in the memory to: run one or more scripts configured to organize information related to the one or more application vulnerabilities.
9. The computing device as claimed in claim 6 , wherein one or more results of the correlation are represented in the form of a bipartite graph.
10. The computing device as claimed in claim 6 , wherein information related to the correlation of the plurality of other dynamic security assessments and the static security assessment and the shortest path to fix the one or more application vulnerabilities is stored in a graph database to facilitate remediation.
11. A non-transitory computer readable medium having stored thereon instructions for fixing application vulnerabilities, the instructions comprising machine executable code which, when executed by a processor, causes the processor to perform steps comprising:
identifying one or more application vulnerabilities through a first dynamic security assessment and a static security assessment of an application;
fixing at least one of a first set of vulnerability instances reported in the static security assessment based on a secure coding practice;
running a plurality of other dynamic security assessments to identify one or more of a second set of vulnerability instances reported in the first dynamic security assessment that have been fixed by the fixing of the at least one of the first set of vulnerability instances reported in the static security assessment;
identifying one or more of a third set of vulnerability instances reported in the plurality of other dynamic security assessments that correspond to the at least one of the first set of vulnerability instances reported in the static security assessment by correlating one or more results of the plurality of other dynamic security assessments and the static security assessment;
determining a shortest path to fix the one or more application vulnerabilities when one or more of the third set of vulnerability instances reported in the plurality of other dynamic security assessments correspond to at least one of the first set of vulnerability instances reported in the static security assessment; and
fixing the one or more vulnerabilities based on the correlation and the shortest path to fix the one or more application vulnerabilities.
12. The non-transitory computer readable medium as claimed in claim 11 , further comprising machine executable code which, when executed by the processor, further causes the processor to perform at least one additional step comprising: creating a database configured to store information related to at least the third set of vulnerability instances reported in the plurality of other dynamic security assessments and the first set of vulnerability instances reported in the static security assessment.
13. The non-transitory computer readable medium as claimed in claim 11 , further comprising machine executable code which, when executed by the processor, further causes the processor to perform at least one additional step comprising: running one or more scripts to organize information related to the one or more application vulnerabilities.
14. The non-transitory computer readable medium as claimed in claim 11 , wherein one or more results of the correlation are represented in the form of a bipartite graph.
15. The non-transitory computer readable medium as claimed in claim 11 , wherein information related to the correlation of the plurality of dynamic security assessments and the static security assessment and the shortest path to fix the one or more application vulnerabilities is stored in a graph database to facilitate remediation.