Overview

Once security assessment is completed as a part of web application development, it's time to go down the path of remediating all of the security problems that have been uncovered. At this point, developers, quality assurance testers, auditors, and security consultants should all be collaborating closely to incorporate security into the current processes of your software development lifecycle in order to mitigate application vulnerabilities.

And with a Web application security assessment report in hand, probably now have long lists of security issues that need to be addressed: low, medium, and high application vulnerabilities; configuration gaffes; and cases in which business-logic errors create security risk.

Our Vulnerability remediation solution helps you to fix identified security issues and also by implementing security controls and/or gates across software development life cycle by automating vulnerability remediation process.

Key Benefits

• Automated Web Vulnerability Remediation -    Supports .NET, JAVA, PHP, Ruby on Rails    and ASP
• Guided vulnerability remediation
• 24/7 Global on demand support
• Remediation plan and regression testing to    ensure vulnerabilities are fixed

Methodology

Our vulnerability remediation process involves four automated and manual steps. However, we handle each vulnerability on a case-by-case basis, so the timeframe and cycle may vary.

1. Collection - We collect vulnerability reports in two ways: monitoring public sources of vulnerability information and processing reports sent directly to us. After receiving reports, we perform an initial surface analysis to eliminate duplicates and false alarms, and then catalog the reports in our database.

2. Analysis - Once the vulnerabilities are cataloged, we determine general severity, considering factors such as the number of affected systems, impact, and attack scenarios. Based on severity and other attributes, we select vulnerabilities for further analysis. Our analysis includes background research, runtime and static analysis, reproduction in our test facilities, and consultation with vendors and other experts.

3. Coordination - When handling direct reports, we work privately with vendors to address vulnerabilities before widespread public disclosure. We have established, secure communication channels with hundreds of technology producers, both directly and through relationships with computer security incident response teams (CSIRTs) all over the world. We have years of experience successfully coordinating responses to vulnerabilities that affect multiple vendors.

4. Remediation – We follow industry accepted best methodologies to fix the vulnerabilities without affecting the performance. COE Security also developed automated web vulnerability remediation tool which can robust applications from legacy to current generation. Our turnaround times to the application vulnerabilities are much lesser than a regular SDLC vulnerability remediation cycle.