[ISM] Root cause analysis:

[SSDF] Perform root cause analysis for security (SSS-04-07-01)

Conduct a root cause analysis for each identified vulnerability to understand the underlying issues. Record these root causes and lessons learned in a searchable, accessible wiki for developers, enabling the team to address similar issues proactively in future development. This knowledge repository fosters continuous improvement by capturing insights that help prevent recurring vulnerabilities.

[SAMM] Identify and manage security defects (SSS-04-07-01-01)

Define a standard understanding of what constitutes a security defect and establish consistent methods to identify them, including threat assessments, penetration testing, and outputs from static or dynamic analysis tools. Use a centralized or accessible system to record all identified defects, allowing teams to gain a comprehensive view of vulnerabilities affecting specific applications at any time. Foster a blame-free culture to encourage transparent reporting and tracking of defects, and implement access control to prevent misuse of sensitive defect data. Introduce a qualitative classification framework to prioritize remediation efforts effectively. Focus on minimizing duplicate entries and false positives to ensure the system's reliability and accuracy. Regularly update this repository to capture lessons learned and enhance future development practices.

Operations

ID	Operation	Description	Phase	Agent
SSS-04-07-01-01-01	Define and track security defects centrally	Establish a centralized tracking system with a standardized definition of security defects and their sources (e.g., penetration tests, scanning tools, bug bounties).	Development	Security team, Development managers
SSS-04-07-01-01-02	Analyze vulnerabilities for root causes	Conduct a root cause analysis (RCA) for identified vulnerabilities to understand how they occurred and document findings in a shared knowledge base.	Deployment	Security team, Development teams
SSS-04-07-01-01-03	Record lessons learned in a searchable wiki	Publish a case study on how a missing input validation flaw was exploited and provide coding best practices to prevent it.	Deployment	Security team, Knowledge management team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1909) NIST Secure Software Development Framework (RV.3.1) OWASP SAMM: Software Assurance Maturity Model (I-DM-1-A)

[SSDF] Identify patterns and systemic root causes (SSS-04-07-02)

Over time, analyze root cause data to identify recurring patterns, such as inconsistent adherence to secure coding practices. Document insights in a developer-accessible wiki, implement automated detection mechanisms to flag similar issues in the future, and update manual processes where necessary. This approach enhances vulnerability prevention by addressing systemic issues across development practices.

[SAMM] Define and utilize advanced defect metrics (SSS-04-07-02-01)

Develop unified metrics to measure security defects across the organization, including the number and severity of defects identified, time to detect and resolve, and windows of exposure for active vulnerabilities. Track regressions or reopened issues and monitor verification activity coverage to ensure comprehensive testing. Introduce metrics for accepted risks and security incidents caused by undocumented defects. Generate periodic reports (e.g., monthly) for stakeholders such as engineers, managers, and security officers. These reports provide actionable insights to refine security strategies, such as enhancing training programs or strengthening verification processes. Regularly share key technical findings and remediation strategies with other teams through knowledge-sharing sessions to reduce the recurrence of vulnerabilities and promote organization-wide learning.

Operations

ID	Operation	Description	Phase	Agent
SSS-04-07-02-01-01	Record root causes and lessons learned	Continuously document root causes identified during vulnerability analyses and track recurring patterns, storing them in a searchable knowledge base.	Post-deployment	Security team, Development teams
SSS-04-07-02-01-02	Define and collect advanced defect metrics	Establish metrics such as defect severities, time to detect (TTD), time to resolve (TTR), and defect regressions to quantify organizational security performance.	Development	Security team, Risk management team
SSS-04-07-02-01-03	Analyze patterns and automate detection	Regularly analyze defect metrics and root causes to identify trends, such as secure coding practices not consistently followed, and implement automated detection mechanisms.	Deployment	Security team, DevOps team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1909) NIST Secure Software Development Framework (RV.3.2) OWASP SAMM: Software Assurance Maturity Model (I-DM-2-B)

[SSDF] Eliminate vulnerability classes proactively (SSS-04-07-03)

Review the software comprehensively for similar vulnerabilities to eliminate entire classes of vulnerabilities rather than remediating individual issues reactively. Use both manual code analysis and automated testing tools to efficiently identify and address vulnerabilities across the codebase, reducing the likelihood of similar security flaws appearing in future releases.

[SAMM] Use metrics to refine and enhance security strategy (SSS-04-07-03-01)

Regularly review defect management metrics to assess their effectiveness and streamline efforts by removing low-value metrics. Automate verification activities where possible to improve data quality and ensure sustainable advancements in security processes. Integrate these metrics with threat intelligence and incident management data to support broader initiatives, including security training, enhancing verification protocols, and conducting supply chain audits. Apply insights to prioritize investments in security infrastructure, staffing, and compensating controls. Monitor attacks on infrastructure and applications, using collected data to address patterns and prevent recurrence of vulnerabilities. Ensure metrics are actionable, driving organizational improvements and supporting a proactive approach to security strategy development.

Operations

ID	Operation	Description	Phase	Agent
SSS-04-07-03-01-01	Conduct vulnerability pattern analysis	Analyze past vulnerabilities to identify recurring patterns or classes of issues, such as improper input validation or outdated dependencies, and proactively search for similar flaws in codebases.	Development	Security team, Development teams
SSS-04-07-03-01-02	Proactively review and fix code	Use manual reviews and automated tools to systematically identify and address vulnerabilities of the identified class across all relevant applications.	Development	Security team, Development managers
SSS-04-07-03-01-03	Revisit and refine security metrics	Regularly evaluate the effectiveness of existing security metrics and remove or refine those that do not deliver expected value. Use metrics to guide security strategy improvements.	Post-deployment	Security team, Risk management team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1909) NIST Secure Software Development Framework (RV.3.3) OWASP SAMM: Software Assurance Maturity Model (I-DM-3-B)

[SSDF] Refine development lifecycle to prevent recurrence (SSS-04-07-04)

Regularly review and refine the software development lifecycle (SDLC) based on insights from root cause analyses to prevent identified vulnerabilities from recurring in future updates or new software. Document improvements and lessons learned in a searchable knowledge base, and integrate necessary changes into SDLC practices, fostering a proactive and preventive approach to software security.

[SAMM] Set strategic KPIs to guide application security goals (SSS-04-07-04-01)

Define and test application security metrics to establish Key Performance Indicators (KPIs) that reflect meaningful and actionable insights into program effectiveness. Eliminate volatility in measurements by focusing on metrics that represent stable, long-term trends. Base KPIs not only on their relevance to security teams but also their value to organizational leadership and application development success. Document KPIs clearly, providing explanations for data sources, expected ranges, and thresholds for intervention. Share these KPIs and their associated action plans transparently with all relevant teams to ensure alignment with organizational goals. Use both short-term and long-term targets to guide ongoing improvements, reinforcing a structured and results-driven approach to refining application security within the SDLC.

Operations

ID	Operation	Description	Phase	Agent
SSS-04-07-04-01-01	Record lessons learned and identify SDLC improvements	Use insights from root cause analysis (RCA) to identify gaps or weaknesses in the SDLC process and document these in a centralized knowledge base.	Post-deployment	Security team, Development teams
SSS-04-07-04-01-02	Update SDLC practices based on RCA findings	Revise SDLC practices to include changes that address recurring vulnerabilities, such as updated design guidelines or mandatory security checkpoints.	Development	Security team, Development leads
SSS-04-07-04-01-03	Define and test application security KPIs	Define strategic KPIs based on meaningful security metrics, ensure data can be consistently gathered, and test them for accuracy and reliability over a short period.	Development	Security team, Risk management team
SSS-04-07-04-01-04	Document, share, and act on KPIs	Fully document KPIs with data sources, acceptable ranges, and action plans for unfavorable measurements. Share them with relevant teams and leadership for transparency.	Post-deployment	Security team, Application leadership

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1909) NIST Secure Software Development Framework (RV.3.4) OWASP SAMM: Software Assurance Maturity Model (G-SM-2-B)