COM-09: Annual External Scanning by Third Party

Implementation of annual external vulnerability scanning by third party for internet-facing infrastructure using OWASP ZAP, Snyk, and WAF

Control Description

On an annual basis, external scanning is performed by a third party for all internet-facing infrastructure to detect new and unknown vulnerabilities. Remediation of all critical/high vulnerabilities is tracked within a ticketing system and is completed within X business days.

Plain Meaning

This control requires engaging an independent third-party vendor to conduct comprehensive vulnerability scans of all internet-facing systems and infrastructure once per year. The third-party scanner should identify security weaknesses that could be exploited from outside the network. When critical or high-severity vulnerabilities are found, they must be documented in a ticketing system and remediated within a specified timeframe.

Automated Scanning: Spider and AJAX Spider for comprehensive crawling
Active Scanning: Automated vulnerability testing with configurable policies
Passive Scanning: Real-time vulnerability detection during browsing
API Testing: REST and GraphQL API security assessment
Custom Scripts: Tailored attack scenarios for specific applications

Configuration:

zap_configuration:
  context:
    name: "Production Web Applications"
    description: "External scanning context for production web apps"
  
  spider:
    max_depth: 10
    max_children: 100
    accept_cookies: true
    
  active_scan:
    policy: "Default Policy"
    max_rule_duration: 5
    max_scan_duration: 60
    
  api_scan:
    endpoints: ["/api/v1/*", "/graphql"]
    authentication: "Bearer Token"
    rate_limiting: true

2. Snyk Security Platform

Purpose: Dependency vulnerability scanning and container security assessment

Capabilities:

Dependency Scanning: Automated detection of vulnerable dependencies
Container Security: Docker image vulnerability assessment
Infrastructure as Code: Terraform and CloudFormation security scanning
License Compliance: Open source license risk assessment
CI/CD Integration: Automated scanning in development pipelines

Integration Points:

snyk_configuration:
  projects:
    - name: "Web Application Dependencies"
      path: "./package.json"
      type: "npm"
    - name: "Container Images"
      path: "./Dockerfile"
      type: "docker"
    - name: "Infrastructure Code"
      path: "./terraform/"
      type: "terraform"
  
  policies:
    fail_on: "high"
    auto_fix: false
    ignore_patterns: ["test/*", "dev/*"]

3. Web Application Firewall (WAF)

Purpose: Real-time protection and automated attack simulation

Capabilities:

Automated Attack Testing: Simulated attacks to validate WAF effectiveness
Real-time Protection: Blocking malicious traffic and attacks
Rate Limiting: Protection against DDoS and brute force attacks
Custom Rules: Application-specific security rules
Threat Intelligence: Integration with threat feeds

Automated Test Attacks:

waf_automated_tests:
  sql_injection:
    enabled: true
    frequency: "weekly"
    patterns:
      - "' OR '1'='1"
      - "'; DROP TABLE users; --"
      - "UNION SELECT * FROM users"
  
  xss_attacks:
    enabled: true
    frequency: "weekly"
    patterns:
      - "<script>alert('XSS')</script>"
      - "javascript:alert('XSS')"
      - "<img src=x onerror=alert('XSS')>"
  
  path_traversal:
    enabled: true
    frequency: "weekly"
    patterns:
      - "../../../etc/passwd"
      - "..\\..\\..\\windows\\system32\\config\\sam"
  
  command_injection:
    enabled: true
    frequency: "weekly"
    patterns:
      - "; ls -la"
      - "| whoami"
      - "&& cat /etc/passwd"