Applying Machine Learning to Application Security (AppSec) triage.
One of the most significant problems facing application security (AppSec) teams is the amount of time it takes to manage the results returned from automated testing tools. Tests may return thousands of potential vulnerabilities, but most AppSec professionals know that only a small fraction of them are worth the time and effort to remediate. AppSec teams comb through these results and triage them—flagging the ones that should be fixed and weeding out the false positives. This process is extraordinarily time-consuming, repetitive, and tedious—but necessary.
Identifying exploitable vulnerabilities is important, and adopting SAST and DAST tools are proven ways of doing so. At the same time, development teams are dealing with constantly shortening deadlines for delivering new functionality. Even moderate levels of issues, false positives, and insignificant results that don’t warrant remediation can prevent developers from adopting these application security testing tools.
Finding exploitable true positive issues is critical to producing secure software. Reducing the number of trivial positives in findings is important because triage is an expensive process. In a typical deep scan, a single tool can return thousands of findings, and best practice would be to use multiple tools, each producing a combination of unique and redundant findings. Applying this to the results from NIST research where even moderate results of 1,000 findings can take over 20 days to triage. Had the tools been more precise, for every 240 insignificant or false findings eliminated, an organisation saves a full work week of effort by a security analyst.
This eBook takes you through how Machine Learning offers a solution to this problem and how Synopsys implements machine learning that can be applied to automate the triage process and examines solutions already on the market.
Click the link below to download the Automate AppSec Triage With Machine Learning eBook
Send download link to:
Application Security Solutions | Code Dx Brochure | Contact us
