Establish and Document the Application's Security Reviews and Remediations

This chapter explains how to establish and document the security reviews an Application undergoes and how their findings are remediated.

What Counts as a Security Review

In this document, a security review is any structured examination of an Application’s security, including security design and architecture reviews, vulnerability scans, and penetration tests. Each produces findings that must be tracked to remediation.

Establish Security Reviews and Remediations

Establish, with Security and the IT Application Owner:

• Which security reviews the Application requires, and how often, based on its criticality, regulatory classification, data sensitivity, and exposure.

• How findings are rated, and the deadlines for remediating findings at each rating.

• Who remediates findings, and who verifies remediation.

• How findings that cannot be remediated in time are handled, through risk acceptance by the appropriate authority and an entry in the Enterprise Risk Register.

For frequent automated scans, record the latest results and open findings for each Release, rather than every individual scan.

Document and Share Security Reviews and Remediations

In the Security section of the Application Documentation, record for each security review its type, date, scope (for example which Instance and which Release), who performed it, its findings, and each finding’s remediation status and due date. Reference the Software Bill of Materials for the Release reviewed. Because detailed findings can help attackers, restrict access to them, as permitted by the guardrails described in the chapter “Practice ‘All Eyes On The Documentation’ — Open Reading and Writing for All Stakeholders,” while keeping summary status visible to the Application’s owners and stakeholders.

Best Practice: Establish and Document the Application’s Security Reviews and Remediations

It is a best practice to both establish and document the solution for an Application’s security assurance: define which reviews it requires and how often, track every finding to remediation by its deadline, record risk acceptance where remediation is not possible, and restrict access to detailed findings.

Benefits: Tracking security reviews and their remediations ensures that findings are actually fixed, not merely reported, and gives leadership and auditors a clear view of each Application’s security posture. Restricting detailed findings protects the enterprise from having its own documentation used against it.

Connections to Related IF4IT Practices and Inventories

The Application Portfolio Management (APM) Best Practices addresses assessing the security posture of every application in the portfolio. The IT Operating Environments Best Practices addresses vulnerability management across environments.