Unified Software Risk Score Calculation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security analysis tools struggle to provide a comprehensive risk assessment across multiple categories, such as SAST, DAST, IAST, and OSA, as they generate different metrics that do not account for stale findings or changes over time, leading to incomplete risk evaluation.
Innovation Solution
A system and method that computes category risk scores from findings generated by multiple software security analysis tools, including SAST, DAST, IAST, and OSA, and updates the overall risk score based on the frequency of scans, age of findings, and frequency of reviews, using a weighted average to provide a normalized risk assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple software security analysis tools (SAST, DAST, IAST, OSA) are used to perform scans, then the comprehensiveness of risk assessment is improved, but the complexity of integrating and normalizing different metrics from these tools increases
Solution Approach 1:
The patent introduces a risk assessment system as an intermediary layer between multiple security analysis tools and the final risk score. This system receives findings from various tools (SAST, DAST, IAST, OSA), normalizes their different metrics into a common framework, and produces a unified risk score. The intermediary handles the complexity of integration internally while presenting a simplified output to users.
Solution Approach 2:
The risk assessment system is designed with universal functionality to handle multiple categories of security tools simultaneously. It implements a unified normalization framework that can process findings from different tool types (SAST, DAST, IAST, OSA) through common calculation logic, making the system adaptable to various tool combinations without requiring separate integration approaches for each tool category.
2Measurement precision
If traditional static metrics from security tools are used, then the simplicity of measurement is maintained, but the accuracy of current risk evaluation deteriorates due to stale findings not accounting for time-based changes
Solution Approach 1:
The patent transforms static risk metrics into dynamic assessments by introducing time-based adjustment factors. The system continuously updates risk scores based on the recency of scans, age of findings, and frequency of reviews. This dynamic approach ensures that risk evaluations reflect current security posture rather than historical data, with scores automatically adjusting as new information becomes available.
Solution Approach 2:
The system implements feedback mechanisms where risk scores are continuously refined based on new scan results and finding ages. The time-based adjustment factors create a feedback loop that rewards frequent scanning and finding remediation by lowering risk scores, while stale findings automatically increase risk scores, prompting re-scanning. This feedback ensures the risk assessment remains current and actionable.
3Reliability
If risk scores are updated frequently to reflect current security posture, then the timeliness of risk information is improved, but the computational resources and time required for continuous assessment increase
Solution Approach 1:
The system employs periodic action by scheduling risk score updates based on predetermined criteria such as scan frequency thresholds and finding age thresholds. Rather than continuously recalculating scores in real-time, the system updates scores at intervals triggered by specific events (new scan completion, finding age milestones), reducing computational overhead while maintaining timely risk information.
Solution Approach 2:
The system dynamically adjusts calculation parameters based on the current state of security findings. For example, it modifies the weight of time-based adjustment factors based on the recency of scans and the age distribution of findings. This parameter adaptation allows the system to focus computational resources on the most relevant risk factors at any given time, improving efficiency while maintaining accuracy.
Data Source
AI summary
A system for assessing software risks includes a non-transitory computer readable medium and a processor. The non-transitory computer readable medium stores category risk scores based on findings generated by software security analysis tools of different categories. The processor receives at least one first finding from a first category of software security analysis tools and at least one second finding from a second category of software security analysis tools. A first category risk score is computed based on the at least one first finding. A second category risk score is computed based on the at least one second finding. An overall risk score for application code is determined by computing a weighted average based on the first category risk score and the second category risk score. A graphical user interface displays the overall risk score.