Methods and systems for determining software risk scores
A system for assessing software risks includes a non-transitory computer readable medium and a processor. The non-transitory computer readable medium stores category risk scores based on findings generated by software security analysis tools of different categories. The processor receives at least one first finding from a first category of software security analysis tools and at least one second finding from a second category of software security analysis tools. A first category risk score is computed based on the at least one first finding. A second category risk score is computed based on the at least one second finding. An overall risk score for application code is determined by computing a weighted average based on the first category risk score and the second category risk score. A graphical user interface displays the overall risk score.
1. A system for assessing software risks, comprising:
a non-transitory computer readable medium for storing category risk scores based on software security analysis findings generated by software security analysis tools of a plurality of categories that perform scans of application code, the plurality of categories including at least two of the following categories: a category for performing Static Application Security Testing (SAST), a category for performing Open Source Analysis (OSA), a category for performing Dynamic Application Security Testing (DAST), and a category for performing Interactive Application Security Testing (IAST); and
a processor configured to:
receive at least one first finding from a tool of a first category of the plurality of categories of software security analysis tools;
compute a first category risk score based on the at least one first finding;
receive at least one second finding from a tool of a second category of the plurality of categories of software security analysis tools, the second category being different from the first category;
compute a second category risk score based on the at least one second finding;
determine an overall risk score for the application code by computing a weighted average based on the first category risk score and the second category risk score; and
display the overall risk score on a graphical user interface.
2. The system of claim 1 , wherein the first category risk score and the second category risk score each distinctly represent one of the following: static vulnerability score, open source vulnerability score, open source license score, dynamic vulnerability score and interactive vulnerability score.
3. The system of claim 1 , wherein the processor is configured to:
receive at least one third finding from a tool of the second category of software security analysis tools;
compute a third category risk score based on the at least one third finding; and
determine the overall risk score for the application code by computing the weighted average based on the first category risk score, the second category risk score and the third category risk score.
4. The system of claim 1 , wherein the processor is configured to update the overall risk score for the application code over time based at least on one of the following: frequency of scan performed by each category of software security analysis tools, age of findings, and frequency of findings review.
5. The system of claim 1 , wherein each finding is associated with a risk level of a plurality of different risk levels, wherein each risk level is associated with deduction points for computing the category risk score, findings of the same risk level have the same deduction points.
6. The system of claim 5 , wherein at least one risk level has a maximum deduction threshold, such that once the maximum deduction threshold is met, further findings of the same risk level are disregarded for computing the category risk score.
7. The system of claim 1 , wherein the processor is configured to:
receive at least another finding from a tool of the first category of software security analysis tools,
determine whether to update the first category risk score based on the at least another finding; and
update the overall risk score when the first category risk score is updated.
8. The system of claim 7 , wherein the at least another finding and the first finding are generated by different software security analysis tools of the first category.
9. The system of claim 7 , wherein the at least another finding and the first finding are generated by the same software security analysis tool of the first category.
10. The system of claim 7 , wherein the at least another finding and the first finding are generated in different scan sessions.
11. The system of claim 7 , wherein the at least another finding and the first finding are generated during the same scan session.
12. The system of claim 7 , wherein the processor determines to maintain the first category risk score without update when the at least another finding duplicates the first finding.
13. The system of claim 7 , wherein the processor is configured to determine to maintain the first category risk score without update when the at least another finding and the first finding are of the same risk level which has a maximum deduction threshold that has been met.
14. The system of claim 1 , wherein each software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution.
15. A system for assessing software risks, comprising:
a non-transitory computer readable medium storing category risk scores based on software security analysis findings generated by software security analysis tools of different categories: and
a processor configured to:
receive at least one first finding from at least one SAST tool that performs a scan of application code;
compute a static vulnerability score based on the at least one first finding;
receive at least one second finding and at least one third finding from at least one OSA tool that performs a scan of the application code;
compute an open source vulnerability score based on the at least one second finding;
compute an open source license score based on the at least one third finding;
determine an overall risk score for the application code by computing a weighted average based on the static vulnerability score, the open source vulnerability score, and the open source license score; and
display the overall risk score for the application code on a graphical user interface.
16. The system of claim 15 , wherein the processor is configured to update the overall risk score for the application code over time based at least on one of the following: frequency of scan performed by each category of software security analysis tools, age of findings, and frequency of findings review.
17. A system for assessing software risks, comprising:
a non-transitory computer readable medium storing category risk scores based on software security analysis findings generated by software security analysis tools of different categories: and
a processor configured to:
receive at least one first finding from at least one SAST tool that performs a scan of application code;
compute a static vulnerability score based on the at least one first finding;
receive at least one second finding and at least one third finding from at least one OSA tool that performs a scan of the application code;
compute an open source vulnerability score based on the at least one second finding;
compute an open source license score based on the at least one third finding;
receive at least one fourth finding from at least one DAST tool that performs a scan of the application code;
compute a dynamic vulnerability score based on the at least one fourth finding;
determine an overall risk score for the application code by computing a weighted average based on the static vulnerability score, the open source vulnerability score, the open source license score, and the dynamic vulnerability score; and
display the overall risk score for the application code on a graphical user interface.
18. The system of claim 17 , wherein the processor is configured to update the overall risk score for the application code over time based at least on one of the following: frequency of scan performed by each category of software security analysis tools, age of findings, and frequency of findings review.