Please Stop Managing Vulnerabilities in Excel Spreadsheets
This blog has been updated with new information for 2020.
Do your best Excel users work in application security? Are you trying to manage thousands of vulnerabilities across hundreds of applications in an increasingly elaborate series of Excel spreadsheets? Most companies are using multiple scanning technologies as well as a variety of manual testing practices and need to have a single view into current open vulnerabilities as well as the ability to report on resolution performance. Excel is a wonderful tool, but it doesn’t always scale. Or, more correctly, application vulnerability management programs can’t scale if they’re based on Excel.
Why not?
- Merging the results of different reports to de-duplicate vulnerabilities must be done manually and it is time-consuming and error-prone
- Comparing incremental scans from the same scanner to identify when vulnerabilities appear, disappear and reappear has to be done manually as well
- Excel only tracks data for a single point in time and doesn’t maintain a usable version history that can be used for reporting. If you want to track when vulnerability states change you have to do it manually. You might be able to keep track of different versions if you store the spreadsheets in SharePoint or a similar system, but that isn’t really a solution.
- And so on…
- Managing all of your development teams and applications in a single, centralized location
- Importing vulnerability data from a variety of sources – static scanners, dynamic scanners, SaaS providers – into a vendor-independent data format and merging/de-duping those vulnerabilities into a single, unified list
- Tracking the results of scanning over time so that you can run reports on the types of vulnerabilities you’re identifying, which vulnerabilities have been addressed and how long they take to fix.
Updated 7/14/20:
Well it has been almost eight years since I originally made this blog post and a lot of things have changed:
- ThreadFix now does even better supporting application security teams by importing Software Composition Analysis (SCA) results for open source libraries with vulnerabilities as well as providing direct support for application penetration testing teams.
- ThreadFix now allows you to import the results of network and infrastructure security scanners like Nessus, Nexpose, and Qualys – and it allows you to correlate between applications and the infrastructure supporting those applications
- DevSecOps teams are aggressively looking to “shift left” and incorporate security testing into CI/CD pipelines, and ThreadFix makes this easy to do via our Jenkins plugin and CI/CD pass/fail policies.
- ThreadFix is unfortunately no longer open source. The code is still online but we stopped maintaining it a while ago. This was a tough decision but was necessary given the costs of maintaining the development team.
One thing that hasn’t changed? Too many organizations we talk to are still trying to run their vulnerability management programs on Excel spreadsheets! Doing this for a handful of applications and developers would be a mess. Trying to do it for tens, hundreds, or thousands of applications is a disaster. Application security is a problem that is never going to be “solved,” but teams can make progress and meaningfully impact the security of the software they are releasing for the better, but only if they take a programmatic view of the problem and arm themselves with the tools and automation needed to scale.
–Dan
dan _at_ denimgroup.com