I am working on a .NET MVC based project involving an application with over 50,000 unique entry points.
Using our own custom static code analysis built using the .NET reflection libraries we have been able to identify a significant number of flagged security high risk end points (based on security authorisation attributes). Using tools such as Fortify provides too many false positives due to the AAA (Auth) model being entirely custom built and along a very different road to MS recommendations.
For our short term main focus we have currently limited it to some public facing entry points that have high usage (such as login, account management services). These services alone have approx 100 entry points, many of which are just obsolete redirects to the correct service.
In terms of application management in the SDLC (in particular for compliance evidence, proving they are safe), how can these points be monitored and managed? Our static code analysis has them flagged, but it doesn't do anything else.
My view is these entry points should be removed and managed via redirects in some other fashion in IIS, but ive been advised this is not an option for compatibility between the older applications that use these services (a problem for another day).
The only other things I can think of is:
Building auditing services into these services to record when the obsolete services are being called.
Place unit testing on the services (potentially check a redirect occurred).
Add black flags in source control to alert that a security engineer should conduct code review if anything changes in these services.
- Adding a partial class file with only the obsolete methods and placing a lock on changing the file.
The biggest thing I am having trouble with is convincing myself (and compliance) these processes are actually occurring. We have over 300 developers on the project, not a small easy to manage team. How do you confirm all processes are being met (i.e how do you confirm a unit test is on all services)?
Has anyone been in similar situations? How did you confirm these mitigation's are being carried out for large systems?