[ISM] Root cause analysis:

[SSDF] Perform root cause analysis for security (SSS-04-07-01)

Conduct a root cause analysis for each identified vulnerability to understand the underlying issues. Record these root causes and lessons learned in a searchable, accessible wiki for developers, enabling the team to address similar issues proactively in future development. This knowledge repository fosters continuous improvement by capturing insights that help prevent recurring vulnerabilities.

[SAMM] Identify and manage security defects (SSS-04-07-01-01)

Define a standard understanding of what constitutes a security defect and establish consistent methods to identify them, including threat assessments, penetration testing, and outputs from static or dynamic analysis tools. Use a centralized or accessible system to record all identified defects, allowing teams to gain a comprehensive view of vulnerabilities affecting specific applications at any time. Foster a blame-free culture to encourage transparent reporting and tracking of defects, and implement access control to prevent misuse of sensitive defect data. Introduce a qualitative classification framework to prioritize remediation efforts effectively. Focus on minimizing duplicate entries and false positives to ensure the system's reliability and accuracy. Regularly update this repository to capture lessons learned and enhance future development practices.

Operations

ID	Operation	Description	Phase	Agent
SSS-04-07-01-01-01	Define and track security defects centrally	Establish a centralized tracking system with a standardized definition of security defects and their sources (e.g., penetration tests, scanning tools, bug bounties).	Development	Security team, Development managers
SSS-04-07-01-01-02	Analyze vulnerabilities for root causes	Conduct a root cause analysis (RCA) for identified vulnerabilities to understand how they occurred and document findings in a shared knowledge base.	Deployment	Security team, Development teams
SSS-04-07-01-01-03	Record lessons learned in a searchable wiki	Publish a case study on how a missing input validation flaw was exploited and provide coding best practices to prevent it.	Deployment	Security team, Knowledge management team

References

Industry framework	Academic work	Real-world case
Information Security Manual (ISM-1909) NIST Secure Software Development Framework (RV.3.1) OWASP SAMM: Software Assurance Maturity Model (I-DM-1-A)