Summary

The following is a list of resources on mitigating, remediating, and preventing vulnerabilities, for system owners that receive a vulnerability reports via their CVD process. After validation is performed on the report, these resources assist in determining an appropriate remediation response. 

Vulnerabilities present in current operational systems must be remediated after a proper validation and risk assessment are performed. Custom development should integrate secure coding practices, and risk analysis should be performed before the custom web application is placed on the internet in operation.

Overview

Vulnerability mitigation consists of two distinct processes.

First, during development and deployment, web applications should be developed with secure coding practices after threat modeling, risk analysis, and secure design are is performed. The application should be deployed following best system administration practices. Testing tools can be used identify vulnerabilities before the application is deployed.

Second, after deployment, vulnerabilities discovered in active production web applications will need to be remediated based on severity, impact, threat, and other risk factors. Testing tools can again be used to identify vulnerabilities and help monitor deployed applications.

Below are resources that may be useful for secure design and development, testing and vulnerability identification, understanding common web application vulnerabilities, and vulnerability mitigation and remediation.

Testing and Validation of Web Vulnerabilities

To perform testing and validation of reported web vulnerabilities, we recommend the use of a Windows virtual machine (VM) running a recent version of Windows with Firefox, Chrome, Burp Suite, and OWASP ZAP installed, along with any dependencies. Linux and/or Mac OS systems are recommended for additional tool support, but are not necessary.

To the extent possible, validation is best performed from an open public internet-like network. Enterprise web proxy or other filtering or inspection systems can negatively affect the behavior of validation tools. In many cases, it’s possible to configure the tools to be proxy-aware, however some proxy or inspection systems can prevent tools from functioning properly. Firewall rules must allow necessary traffic, usually (but not always) outbound connections to HTTP/S ports TCP 80 and 443. FTP and SMTP services have also been needed in validation.

Client-based Testing Tools

Web-based Testing Tools

Tools may be used during development as well as after deployment. Since standards and best practices change over time, it is a good idea to periodically re-test deployed applications.

Vulnerability Remediation Resources

Once the web application is deployed, the application, server, or other components may need updates, patches, or other changes to address vulnerabilities as they are discovered. In some cases, the system owner or their developer will need to develop the mitigation or remediation.

Development Resources

A threat model of the service or web application being provided should be developed earlier in the process to help make architecture decisions that will keep the application more secure. Below are resources for creating and using a threat model for development or deployment, as well as secure coding development principles.