RV.3 Analyze Vulnerabilities to Identify Their Root Causes

Statement

Analyze identified vulnerabilities to determine their root causes.

Example 1:

Record the root cause of discovered issues.

Example 2:

Record lessons learned through root cause analysis in a wiki that developers can access and search.

Statement

Analyze the root causes over time to identify patterns, such as a particular secure coding practice not being followed consistently.

Example 1:

Record lessons learned through root cause analysis in a wiki that developers can access and search.

Example 2:

Add mechanisms to the toolchain to automatically detect future instances of the root cause.

Example 3:

Update manual processes to detect future instances of the root cause.

Statement

Review the software for similar vulnerabilities to eradicate a class of vulnerabilities, and proactively fix them rather than waiting for external reports.

Example 1:

See PW.7 and PW.8.

Statement

Review the SDLC process, and update it if appropriate to prevent (or reduce the likelihood of) the root cause recurring in updates to the software or in new software that is created.

Example 1:

Record lessons learned through root cause analysis in a wiki that developers can access and search.

Example 2:

Plan and implement changes to the appropriate SDLC practices.