{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Vulnerability & Patch Management","Secure Development (SDLC) & Application Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-inadequate-testing-scanning","description":"Software released without adequate testing, and no regular vulnerability scanning or penetration testing, leaves exploitable defects undiscovered until they manifest — or are exploited — in production.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"medium","risk_id":"vuln-inadequate-testing-scanning","taxonomies":["iso-27005-vulnerability"],"treatment":"mitigate"},"id":"risk:vuln-inadequate-testing-scanning","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Avuln-inadequate-testing-scanning","sourceIds":["cobit-2019","gdpr","iso-27001","nist-800-53","nist-ai-tevv-athlon","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Inadequate vulnerability scanning and pre-release testing","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:29034087236d0f306681d6531032b1127a372bbe15c8f916be173d3d3292ff1d","properties":{"rationale":"Independent penetration testing is the operative defense against the absence of pen testing, validating exploitability.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-02-8366666b.json","sourceId":"uc:UC-VULN-02","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2b584d7fa6882fb7f2428dfe0803cc7312e35435d88ca21bafcd04a2ffce8477","properties":{"rationale":"Obtaining evidence of security testing for outsourced deliverables ensures third-party code is tested/scanned rather than shipped untested.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-10-3ac58852.json","sourceId":"uc:UC-SDLC-10","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:57219d4c9090d24c46a3958113a962c179d5e2d2e2cfa13ac16a857ef447fa1e","properties":{"rationale":"Authenticated scans on a defined cadence are the operative control against absent or irregular vulnerability scanning.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5aa11bf91ae4883afeebd74f06cc34048edc5f4a67e8809e76791fbcdd6b1e94","properties":{"rationale":"Pre-release security testing directly mitigates releasing software with undiscovered exploitable defects.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-04-ed033b30.json","sourceId":"uc:UC-CONFIG-04","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:665d86f3919e43b9ee8174131fd9e9ddd0bee870ce9e1aceb926e014ef1cedbb","properties":{"rationale":"Requiring test and approval before implementation directly mitigates releasing inadequately tested software.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6bfc674faffa0a96cb5119482dee591d0243706b16e033ffdc8301a82b1dffe8","properties":{"rationale":"A coordinated external vulnerability-disclosure channel surfaces exploitable defects that inadequate internal testing missed.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-asset-09-911f6a6c.json","sourceId":"uc:UC-ASSET-09","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:97693356e4ec168acdfb5d63563e72f43b71fb243889ea0d03e9a4670dbf0c78","properties":{"rationale":"Mandatory security testing at development and acceptance directly prevents software shipping without adequate testing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-04-d07c87cf.json","sourceId":"uc:UC-VULN-04","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9d8569d78b96c66dc575d32d4e15791a5e47056bfb2bfe22aecc7d475999ef95","properties":{"rationale":"Verifying adherence via code review and static analysis before release is the pre-release security testing itself.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-05-053afd62.json","sourceId":"uc:UC-SDLC-05","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9e0e557b8c1822f1bce6009d4444d94975f5c783f5c7fa72e4e081b3c5f4b2dc","properties":{"rationale":"Allocating budget/resources for security work funds the testing/tooling that is otherwise cut for cost, an enabler of adequate testing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-02-c3b003c2.json","sourceId":"uc:UC-SDLC-02","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:abf7ed8d7b7a0a3f7db28f2713b29fef6ba0e4e2822a69a31a57217c46803f66","properties":{"rationale":"Mandatory testing in non-production before approval/migration directly prevents releasing inadequately tested software to production.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-access-16-7a8d6d65.json","sourceId":"uc:UC-ACCESS-16","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cebed2c98d42090e10871e699dfc86b2cc7c26932e04018a0099a02ae9fefa28","properties":{"rationale":"Mandated security activities and test/approval gates before release ensure software is tested rather than shipped untested.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-01-b3583fd1.json","sourceId":"uc:UC-SDLC-01","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ff8dabc6f297d93840a289d21d8c8d9e1bc7ae983cde983730b0d0506d394e86","properties":{"rationale":"A mandatory acceptance-test gate prevents inadequately-tested software from reaching production.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-sdlc-07-22470d8b.json","sourceId":"uc:UC-SDLC-07","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"}],"schemaVersion":1}