Security Testing Root Cause Analysis: A New Way of Reporting
At 7 Elements we have introduced an additional way of reporting on the findings from our security tests, Root Cause Analysis. Whilst root cause analysis is not a new concept, it has not to date been readily applied to security testing output. We feel it is time for a change.
Current Practice
At present it is standard practice across the industry to report on the findings from security tests individually. This is of course necessary so that the extent of each vulnerability and the risk it poses can be understood and appropriate remediation applied. However, this only enables organisations to view one vulnerability at a time and thus results in organisations tackling vulnerabilities on a case by case basis.
What is Security Testing Root Cause Analysis?
The causes of vulnerabilities can often be attributed to a single technical cause, i.e. the root cause. Frequently, vulnerabilities share the same root cause. 7 Elements has developed a new technique that enables us to identify the common technical root causes of vulnerabilities for both Application and Infrastructure findings. In addition to reporting on individual vulnerabilities, 7 Elements also reports on the number of vulnerabilities attributed to common technical root causes, with individual narrative against each root cause.
Example of RCA
Why should we use Root Cause Analysis?
The identification of root causes of vulnerabilities enables organisations to take a more strategic view of their vulnerability management and information security practices. It allows organisations to not only understand where they may have gaps but also why. This enables organisations to take remediation action to tackle a root cause and thus remediating multiple vulnerabilities in a strategic approach.Through our root cause analysis, organisations frequently find that the majority of their vulnerabilities have only a couple of root causes. As a result, by tackling one root cause an organisation is able to tackle multiple vulnerabilities with only one remediation action.
Prevention is better than cure though. By tackling root causes, organisations are able to take preventative action to stop vulnerabilities from arising in the same way in the future and more importantly potentially remediate issues that have yet been identified.
If you would like to know more about how we approach testing and the additional value that we deliver, then please get in touch with our team.