Method and system for remediating cybersecurity vulnerabilities based on utilization
A technology solution for remediating a cyberattack risk for a web application, including receiving device engagement data for the web application, receiving a security scanning analysis from a static application security testing (SAST) tool that includes a security flaw found in the web application and a severity level for the security flaw, and a plurality of other security flaws found in one or more other web applications and severity levels associated with each of the plurality of other security flaws. The technology solution includes determining a plurality of criticality adjustment values for the security flaw and each of the plurality of other security flaws, applying a criticality adjustment value to the security flaw to modify a severity level for the security flaw, prioritizing the security flaw and the plurality of other security flaws based on the modified severity level to generate prioritized security flaw action items, and mitigating the cyberattack risk for the web application according to the prioritized security flaw action items.
1. A method for remediating a cyberattack risk for a web application, the method comprising:
receiving device engagement data for the web application;
receiving a security scanning analysis from a static application security testing (SAST) tool that includes
a security flaw found in the web application and a severity level for the security flaw, and
a plurality of other security flaws found in one or more other web applications and severity levels associated with each of the plurality of other security flaws;
determining a pro rata device engagement value for each of said web application and said one or more other web applications;
determining a plurality of criticality adjustment values for the security flaw and each of the plurality of other security flaws based on said pro rata device engagement values for each of said web application and said one or more other web applications;
applying a criticality adjustment value to the security flaw to modify a severity level for the security flaw;
prioritizing the security flaw and the plurality of other security flaws based on the modified severity level to generate prioritized security flaw action items; and
mitigating the cyberattack risk for the web application according to the prioritized security flaw action items.
2. The method in claim 1 , further comprising:
determining the pro rata device engagement value for said web application by dividing a device engagement value for said web application by a sum of device engagement values for said one or more other web applications; and
applying a criticality adjustment value to each of the plurality of other security flaws.
3. The method in claim 1 , wherein the mitigating the cyberattack risk for the web application comprises transmitting the security flaw and the security scanning analysis to a client device for review or remediation.
4. The method in claim 1 , wherein the device engagement data is received from a Security Information and Event Management (SIEM) system.
5. The method in claim 1 , wherein the device engagement data is received from a webserver log.
6. The method in claim 1 , wherein security scanning analysis includes a security vulnerability matrix comprising a plurality of severity levels.
7. The method in claim 6 , wherein the plurality of severity levels include a high-severity level and a low-severity level.
8. The method in claim 7 , wherein the plurality of severity levels further include a medium-severity level.
9. The method in claim 1 , wherein the severity level for the security flaw includes a medium-severity level that is modified by the criticality adjustment value to a high-severity level based on the device engagement data for the web application.
10. The method in claim 1 , wherein the severity level for the security flaw includes a low-severity level that is modified by the criticality adjustment value to a medium-severity level based on the device engagement data for the web application.
11. The method in claim 1 , wherein the severity level for the security flaw includes a low-severity level that is modified by the criticality adjustment value to a high-severity level based on the device engagement data for the web application.
12. A non-transitory computer readable medium having stored thereon instructions for remediating a cyberattack risk for a web application comprising machine executable code which, when executed by at least one computing device, causes the at least one computing device to perform steps comprising:
receiving device engagement data for the web application;
receiving a security scanning analysis from a static application security testing (SAST) tool that includes a security flaw found in the web application and a severity level for the security flaw, and a plurality of other security flaws found in one or more other web applications and severity levels associated with each of the plurality of other security flaws;
determining a pro rata device engagement value for each of said web application and said one or more other web applications;
determining criticality adjustment values for the security flaw and each of the plurality of other security flaws based on said pro rata device engagement values for each of said web application and said one or more other web applications;
applying a criticality adjustment value to the security flaw to modify a severity level for the security flaw;
prioritizing the security flaw and the plurality of other security flaws based on the modified severity level to generate prioritized security flaw action items; and
mitigating the cyberattack risk for the web application according to the prioritized security flaw action items.
13. The non-transitory computer readable medium in claim 12 , wherein the mitigating the cyberattack risk for the web application comprises transmitting the security flaw and the security scanning analysis to a client device for review or remediation.
14. The non-transitory computer readable medium in claim 12 , wherein receiving device engagement data for the web application comprises receiving device engagement data from a Security Information and Event Management (SIEM) system or a webserver log.
15. The non-transitory computer readable medium in claim 12 , wherein security scanning analysis includes a security vulnerability matrix comprising a plurality of severity levels.
16. The non-transitory computer readable medium in claim 15 , wherein the plurality of severity levels include a high-severity level and a low-severity level.
17. The non-transitory computer readable medium in claim 16 , wherein the plurality of severity levels further include a medium-severity level.
18. The non-transitory computer readable medium in claim 12 , wherein applying the criticality adjustment value to the security flaw to modify a severity level for the security flaw comprises:
modifying a medium-severity level by the criticality adjustment value to generate a high-severity level based on the device engagement data for the web application; or
modifying a low-severity level by the criticality adjustment value to generate a medium-severity level or a high-severity level based on the device engagement data for the web application.
19. The non-transitory computer readable medium in claim 12 , wherein applying the criticality adjustment value to the security flaw to modify a severity level for the security flaw comprises:
applying a utilization adjustment vulnerability summary matrix.
20. A cyberattack risk remediation system for remediating a security flaw in a web application, the system comprising:
a vulnerability determiner that receives a security scanning analysis from a static application security testing (SAST) tool that includes a security flaw found in the web application and a severity level for the security flaw, and a plurality of other security flaws found in one or more other web applications and severity levels associated with each of the plurality of other security flaws;
a device engagement determiner that
receives device engagement data for the web application,
determines a pro rata device engagement value for each of said web application and said one or more other web applications,
determines a plurality of criticality adjustment values for the security flaw and each of the plurality of other security flaws based on said pro rata device engagement values for each of said web application and said one or more other web applications,
applies one of the plurality of criticality adjustment values to the security flaw to modify a severity level for the security flaw, and
prioritizes the security flaw and the plurality of other security flaws based on the modified severity level to generate prioritized security flaw action items; and
a remediation determiner that mitigates the security flaw in the web application according to the prioritized security flaw action items.