Skip to content

text# Feature Vulnerability Scanning Tool
Feature ID FEA023
Subsystem the feature is part of Security
Responsible person Developers
Status In Progress

Description

The Feature Vulnerability Scanning Tool is designed to automatically detect security vulnerabilities in the system. It ensures that potential weaknesses in the application, dependencies, and configurations are identified and mitigated before exploitation.

All relevant issues related to or contributing to the definition of the feature are gathered here
[Use Case 1] Developer pushes code, triggering an automatic security scan
FUNC-REQ-S0001 The system must detect and report known vulnerabilities in dependencies
FUNC-REQ-S0002 Security scans should run as part of the CI/CD pipeline
FUNC-REQ-S0003 The system should generate alerts for high-risk vulnerabilities

Preliminary user stories

  • 101 As a security engineer, I want automated vulnerability scans to identify risks early.

  • 102 As a developer, I want real-time alerts on security issues in my code.

Implementation

  • Integrate OWASP Dependency-Check into the CI/CD pipeline.
  • Use GitLab SAST (Static Application Security Testing) for code vulnerability scanning.
  • Implement a logging and reporting mechanism for detected vulnerabilities.
  • Automate periodic security audits for third-party dependencies.
  • Configure alerts for critical security vulnerabilities.
  • Ensure reports are accessible through a dedicated security dashboard.

Testing / possible acceptance criteria

Write down some notions for testing

Testcase Test source Responsible
Testcase 1 FUNC-REQ-S0001 Testers
Testcase 2 FUNC-REQ-S0002 Testers
Testcase 3 FUNC-REQ-S0003 Testers
Testcase 4 SEC-REQ-0010 Testers
Testcase 5 SEC-REQ-0011 Testers
Testcase 6 SEC-REQ-0015 Testers