Automating Vulnerability Remediation: A Continuous SAST and FOSS Integration Framework for Production Support Pipelines (International Journal of Engineering & Extended Technologies Research (IJEETR), 2024)
Financial businesses houses are increasingly relying on a range of critical foundational applications to support core operations. This has in turn given rise to a problem: How to regulate a growing number of bugs in the software, especially those generated by code written in-house. Application code is scanned through the help of Static Application Security Testing (SAST) software as well as free and open-source libraries having been compiled (not; researched) with the help of Free and Open-Source Software (FOSS) ReleasesThis paper will focus on developing a working model for the incorporation of SAST and FOSS vulnerability as part of the application production support processesThis study represents the development, execution and results of embedding a security automation project within day-to-day operational support business processes. The scope covers artifact scanning and risk-based bulleting, along with automated ticketing and principles of iterative feedback, for developer support and delivery, all of which maintains the operational continuity of the applications. The core improvements involve mitigation of vulnerabilities 40% faster on average; effectively reducing the number of ‘open’ vulnerability findings for high severity issues by 65%; and maintaining the integrity of the procedure with respect to in depth customer audits. The study outlines ideas on how organizations can employ a framework on continuous security hygiene especially in such environments
Keywords: SAST; FOSS; Software Composition Analysis; DevSecOps; Vulnerability Remediation; CI/CD; Production Support; Application Security; Technical Debt; Compliance Automation