End-to-end change tracking for triggering website security review
A graph of interrelated computer-executable processes is obtained. That a change has occurred to one of the interrelated computer-executable processes in the graph is determined. A weight of the one of the interrelated computer-executable processes is determined based at least in part on the change. A security review of one or more of the interrelated computer-executable processes is determined to be triggered based at least in part on the weight, and the security review is triggered.
1. A computer-implemented method, comprising:
determining an end-to-end request processing graph for an application frontend of a website, nodes of the end-to-end request processing graph including the application frontend and one or more services that perform processing operations for the application frontend;
identifying a change to a service that corresponds to a node in the end-to-end request processing graph;
assigning a weight associated with the change, the weight indicating a security risk of the change, the weight being based at least in part on a difference between a current size of source code of the service and a previous size of the source code of the service;
aggregating the weight with an accumulated weight of changes to services of the end-to-end request processing graph to produce a new accumulated weight; and
triggering, based at least in part on the new accumulated weight reaching a value relative to a threshold value, a security review of at least the application frontend.
2. The computer-implemented method of claim 1 , wherein the weight is further based at least in part on one or more of:
a privilege associated with the service, or
sensitivity of data processed by the service.
3. The computer-implemented method of claim 1 , wherein the security review includes one or more of:
an automated scan of the application frontend,
a manual security review of the application frontend, or
an automated scan of the one or more services.
4. The computer-implemented method of claim 1 , wherein the change is identified as a result of storage of source code of the service in a repository.
5. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
determine an end-to-end request processing graph for an application frontend of a website, nodes of the end-to-end request processing graph including the application frontend and one or more services that perform processing operations for the application frontend;
identify a change to a service that corresponds to a node in the end-to-end request processing graph;
assign a weight associated with the change, the weight indicating a security risk of the change, the weight being based at least in part on a difference between a current size of source code of the service and a previous size of the source code of the service;
aggregate the weight with an accumulated weight of changes to services of the end-to-end request processing graph to produce a new accumulated weight; and
trigger, based at least in part on the new accumulated weight reaching a value relative to a threshold value, a security review of at least the application frontend.
6. The non-transitory computer-readable storage medium of claim 5 , wherein:
the one or more services include a first computer-executable process and a second computer-executable process; and
an edge in the end-to-end request processing graph indicates that the first computer-executable process causes the second computer-executable process to perform an operation.
7. The non-transitory computer-readable storage medium of claim 5 , wherein the weight is determined based at least in part on whether one of the one or more services has previously passed a security assurance review.
8. The non-transitory computer-readable storage medium of claim 5 , wherein the weight is determined based at least in part on whether one of the one or more services has access to a cryptographic key.
9. The non-transitory computer-readable storage medium of claim 5 , wherein the executable instructions that cause the computer system to trigger the security review include instructions that cause the computer system to send a notification to an automated security review entity thereby triggering the automated security review entity to perform the security review of one or more of the one or more services.
10. The non-transitory computer-readable storage medium of claim 5 , wherein the weight is determined based at least in part on a track record of secure coding by a developer of one of the one or more services.
11. The non-transitory computer-readable storage medium of claim 5 , wherein the change is an update to cryptographic key material used by one of the one or more services.
12. A system, comprising:
at least one computing device that implement one or more services, wherein the one or more services:
determine an end-to-end request processing graph for an application frontend of a website, nodes of the end-to-end request processing graph including the application frontend and one or more services that perform processing operations for the application frontend;
identify a change to a service that corresponds to a node in the end-to-end request processing graph;
assign a weight associated with the change, the weight indicating a security risk of the change, the weight being based at least in part on a difference between a current size of source code of the service and a previous size of the source code of the service;
aggregate the weight with an accumulated weight of changes to services of the end-to-end request processing graph to produce a new accumulated weight; and
trigger, based at least in part on the new accumulated weight reaching a value relative to a threshold value, a security review of at least the application frontend.
13. The system of claim 12 , wherein the change is identified as a result of storage of source code of the service in a repository.
14. The system of claim 12 , wherein the one or more services further reset the new accumulated weight to a baseline value.
15. The system of claim 12 , wherein the weight is further based at least in part on a value that indicates a sensitivity of data processed by the service.
16. The system of claim 15 , wherein the one or more services further determine the sensitivity of the data being based at least in part on passing characteristics of the change as input to a machine learning algorithm.
17. The system of claim 12 , wherein the one or more services further, as a result of determining to trigger the security review, send a notification to a security review entity to trigger the security review.
18. The system of claim 17 , wherein the security review includes an automated review of at least the application frontend associated with the end-to-end request processing graph.
19. The system of claim 12 , wherein the one or more services that determine the end-to-end request processing graph, as a result of a request call made by the application frontend to a backend service, trace a set of request calls made to one or more backend services to determine the end-to-end request processing graph.
20. The system of claim 19 , wherein the set of request calls include at least one request identifier that associates the set of request calls with the request call made by the application frontend.