A computer-implemented system for identifying security risks and controlling a release of at least one software application containing vulnerable codes, said system comprising:
- a processor;
- and
- a memory storing computer-executable instructions, which when executed by the processor cause the processor to:
- generate a specific release build of the software application, and check for a vulnerability state of the specific release build check for vulnerabilities and the security risks in the software application;
- define a plurality of service level agreements for a release of the software application, and wherein the release includes a global release of the software application and a specific release of the software application, and wherein defining the plurality of SLAs for the global release further includes applying the plurality of SLAs to all products, subproducts, and microservices, and wherein defining the plurality of SLAs for the specific release further includes applying the plurality of SLAs to at least one of a specific product, a specific subproduct, and a specific environment, at at least one of an application level, a microservice level, and an environment level;
- prioritize the plurality of service level agreements (SLAs) into Level 1 SLAs, Level 2 SLAs, and Level 3 SLAs, and wherein the Level 1 SLAs comprise a predetermined number of critical, high, medium, and low vulnerabilities allowed to pass through the release, and wherein any number of the critical, high, medium, and low vulnerabilities exceeding the predetermined number of critical, high, medium, and low vulnerabilities are blocked from the release, and wherein the Level 2 SLAs define a list of critical tools, that when not executed, cause the release of the software application to be blocked, and wherein the Level 3 SLAs define flexible risk parameters, including a threat intelligence score and compliance deviance to be implemented during the release of the software application;
- download a script from a vulnerability management platform, wherein the script contains a vulnerability management platform API, and insert downloaded script into a release build pipeline created by a build and continuous integration (CI) tool, and trigger the vulnerability management platform to ingest vulnerabilities from a plurality of vulnerability detection tools, penetration testing results, manual security research results, and secure code review results;
- trigger the release build pipeline and the downloaded script embedding the vulnerability management platform API;
- check the vulnerability state for the specific release build by using at least one scanning tool, and trigger the vulnerability management platform to record the release of the software application and a status of the vulnerability state at a time of the release of the software application;
- trigger the vulnerability management platform API to return a FAIL code and block the release build pipeline of the software application in an event the vulnerability state of the release exceeds a predetermined threshold;
- trigger the vulnerability management platform API to allow the release of the software application in an event the vulnerability state is determined to be below the predetermined threshold and further trigger the vulnerability management platform API to blocking the release of the software application if the vulnerability state is determined to be above the predetermined threshold, and further trigger the vulnerability management platform API to determine the vulnerability state based on the Level 1 SLAs, the Level 2 SLAs, and the Level 3 SLAs;
- trigger the vulnerability management platform to record each failed release attempt of the software application, along with issues present at a time of the failed release attempt;
- and
- implement an exception release approval procedure by setting a baseline, the baseline defining a predetermined set of vulnerabilities, and wherein the exception release approval procedure includes approving exceptions in the software application and allowing the release of the software application in a subsequent release attempt performed on the release build pipeline, and wherein an implementation of the exception release approval procedure by setting the baseline further includes:
- ignoring specific vulnerabilities in the baseline during the subsequent release attempt and applying the baseline to incremental vulnerabilities;
- allowing a current set of vulnerabilities to pass through, even when the exceptions corresponding to the current set of vulnerabilities violate at least one of the plurality of SLAs;
- and wherein the release of the software application is allowed over the baseline, in an event the software application contains vulnerabilities that are a subset of the predetermined set of vulnerabilities defining the baseline, and wherein new vulnerabilities that do not belong to the predetermined set of vulnerabilities are tested against a predefined release gate criteria.