I am working on a .NET MVC based project involving an application with over 50,000 unique entry points.

Using our own custom static code analysis built using the .NET reflection libraries we have been able to identify a significant number of flagged security high risk end points (based on security authorisation attributes). Using tools such as Fortify provides too many false positives due to the AAA (Auth) model being entirely custom built and along a very different road to MS recommendations.

For our short term main focus we have currently limited it to some public facing entry points that have high usage (such as login, account management services). These services alone have approx 100 entry points, many of which are just obsolete redirects to the correct service.

In terms of application management in the SDLC (in particular for compliance evidence, proving they are safe), how can these points be monitored and managed? Our static code analysis has them flagged, but it doesn't do anything else.

My view is these entry points should be removed and managed via redirects in some other fashion in IIS, but ive been advised this is not an option for compatibility between the older applications that use these services (a problem for another day).

The only other things I can think of is:

  • Building auditing services into these services to record when the obsolete services are being called.

  • Place unit testing on the services (potentially check a redirect occurred).

  • Add black flags in source control to alert that a security engineer should conduct code review if anything changes in these services.

    • Adding a partial class file with only the obsolete methods and placing a lock on changing the file.

The biggest thing I am having trouble with is convincing myself (and compliance) these processes are actually occurring. We have over 300 developers on the project, not a small easy to manage team. How do you confirm all processes are being met (i.e how do you confirm a unit test is on all services)?

Has anyone been in similar situations? How did you confirm these mitigation's are being carried out for large systems?


  • I am eager to answer this question only if more summary could be put across the table. HP Fortify could be used as a static code analyzer but this doesn't ensure dynamic scanning plus business logic security which's done manually by skilled security testers. As for the compliances, what change management mechanism does your organization use? – Shritam Bhowmick May 2 '17 at 5:59
  • @ShritamBhowmick Fortify has given us too many false positives as our Authorisation and entire AAA model is completely custom and well away from standard MS practices. Im basically looking for evidence these obsolete methods have checks in place as I can't remove them but am aware they are there. I have not had much involvement in compliance yet as my project focus has been working with development teams. I know PCI DSS is the current scope and the auditing firm has basically pushed the old "wheres the evidence" point, which would also help me sleep better if it was in place. – Cyassin May 2 '17 at 23:14
  • Without evidence of sustained security control due care, banks and credit card companies will not allow a merchant to accept credit cards for payment. Are you trying to automate the whole process of evidences as that'd likely involve other ingredients for e.g. Gap Analysis. – Shritam Bhowmick May 3 '17 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.