How to Approach Remediation, What to Fix First?

When development teams start using application security testing tools such as SAST/DAST, the number of security flaws found by the automation tools can be overwhelming. Teams often find themselves under the pressure to quickly resolve the vulnerabilities identified by automation but have no idea where or how to start. 

Let’s begin with some pre-work, typically done by the program admins: 

Check which policy is in use

Implement achievable policies at first 

If security is being introduced or enforced for the first time, start off with some achievable policy standards. Don’t make a team that has never had security built into their daily cycle try to meet PCI or all OWASP requirements; they will not pass, and will feel defeated and give up before they start. 

Start with a simple policy: no high or very high critical flaws. Then get more stringent over time as developers adopt security into their daily routine. 

In addition, how long do they have to fix something that is found? Add grace periods based on the criticality of the flaw (i.e., a very high critical flaw needs to be fixed in five days; a medium critical flaw needs to be fixed in 15 days; a low critical flaw is not required to be fixed). Get more details on application security policies in our guide Policy Matters. 

Review scan results 

Once your scanning completes you can use the Veracode Platform UI, or download our free plug-in for your IDE to easily view and filter your results to prioritize any remediation or mitigation.  See https://help.veracode.com/r/review_remediationplan. 

So that completes the prework, now it’s time to fix!  

Defining Which Flaws to Fix 

Fix First: Severity and Ease of Fix  

If you do not have any particular policy that you need to pass, you can use the Fix First Analyzer for a visual representation of exactly which flaws to fix first to improve the overall security posture of the application. You can view flaws based on severity of the flaw and the difficulty to fix the flaw.  

To access the Fix First Analyzer, on the Triage Flaws page, select Fix First Analyzer in the top-right corner. The size of the circles on the Fix First Analyzer is proportional to the number of flaws for a given combination of severity and effort to fix. 

To identify a group of flaws within a given severity, click the red circles, starting with the upper right-hand quadrant. The chart displays the list of flaws you must remediate to decrease the application's risk quickly, with the least amount of effort. To see all flaws again after choosing one of the circles, click Clear Filter. 

Prioritizing by Exploitability 

Within a given group of flaws in the Fix First Analyzer, you can sort the flaws by exploitability to further prioritize the flaws, beginning with flaws that are Very Likely to be exploited. 

Some flaws have additional information about the likelihood that they will be exploited, based on contextual analysis of the dataflow. For example, flaws could show the source of a potential tainted data input, whether any attempt is made to cleanse the data, and so on. These flaws have an information icon  next to the exploitability rating, which provides additional information about the likelihood the flaw can be exploited. 

See How to Start Remediation for Security Flaws where our expert provides some tips below 

• Avoid Dangerous Functions which allowed code execution such as eval() 
• Secure Data Handling 
  • Parameterize data 
  • Contextual encoding the output 
  • Validate input 
  • External sources 
  • Internal sources 
• Protect Data
  • Data at rest 
    • Encrypt – when initial value is required 
    • Hash – when initial vale is NOT required 
  • Data in transit: TLS 
• Remediate per https://owasp.org/www-project-proactive-controls/ 

Schedule a Consultation 

If you still need guidance after following the above recommendations on how to prioritize your work, take advantage of Veracode’s expertise by Scheduling a Consultation Call.  Consultation calls provide you the opportunity to get assistance with configuring and running a scan or with interpreting the findings in your application.  

During scan configuration calls, Veracode can answer specific questions you have about your scan configuration or walk you through the best practices for setting up your scan. During scan results calls, Veracode can help you understand the significance of the findings and provide guidance on remediation and mitigation.