Run Testing Checklist and confirm all tests pass

Oct 13, 2025 by pinkandtrash.com 6 views

Introduction

In February 2025, a WebInspect scan was conducted to identify potential security vulnerabilities in our system. The scan revealed 25 findings related to Security and Compliance (SI-2) controls. As part of our ongoing efforts to ensure the security and integrity of our system, we need to remediate or flag as false positives the 2 findings related to SI-2 controls. In this article, we will outline the steps to be taken to address these findings and provide a detailed plan for remediation.

Understanding SI-2 Controls

SI-2 controls are a set of security and compliance controls that are designed to ensure the confidentiality, integrity, and availability of sensitive information. These controls are critical in preventing unauthorized access, data breaches, and other security threats. The two findings related to SI-2 controls that need to be remediated or flagged as false positives are:

Cache management: headers: This finding indicates that the system is not properly managing cache headers, which can lead to security vulnerabilities.
HTML5: CORS Prolonged Caching of Preflight Response: This finding indicates that the system is not properly configuring CORS (Cross-Origin Resource Sharing) policies, which can lead to security vulnerabilities.

Acceptance Criteria

To complete this issue, the following functional outcomes must be achieved:

Cache management: headers finding addressed
HTML5: CORS Prolonged Caching of Preflight Response finding addressed
HTML5: Overly Permissive CORS Policy finding addressed
Insecure Transport: HSTS not Set finding addressed
Testing Checklist has been run and all tests pass
README is updated, if necessary

Tasks

To deliver the desired outcomes of this issue, the following granular, specific work items must be completed:

Verify finding: Review the WebInspect scan results to verify the findings related to SI-2 controls.
Resolve finding (if needed) or document justification for false-positive: If the finding is a false positive, document the justification for flagging it as such. If the finding is a legitimate security vulnerability, resolve the issue by implementing the necessary security controls.
Run Testing Checklist and confirm all tests pass: Run the Testing Checklist to ensure that all tests pass and that the system is secure.

Supporting Documentation

The following supporting documentation is available:

Scan results: https://gorafttech.sharepoint.com/:f:/r/sites/TDRSResearchDesign/Shared%20Documents/Dev/dev/Security%20Scans/Feb2025

Open Questions

Can this ticket be prioritized for implementation by end of March 2025?

Remediation Plan

To remediate the 2 findings related to SI-2 controls, the following steps will be taken:

Verify finding: Review the WebInspect scan results to verify the findings related to SI-2 controls.
Resolve finding (if needed) or document justification for false-positive: If the finding is a false positive, document the justification for flagging it as such. If the finding is a legitimate security vulnerability, resolve the issue by implementing the necessary security controls.
Run Testing Checklist and confirm all tests pass: Run the Testing Checklist to ensure that all tests pass and that the system is secure.
Update README: Update the README file to reflect the changes made to address the findings.
Verify remediation: Verify that the remediation has been successful by re-running the WebInspect scan.

Timeline

The following timeline is proposed for remediation:

End of February 2025: Verify finding and resolve finding (if needed) or document justification for false-positive.
End of March 2025: Run Testing Checklist and confirm all tests pass.
End of March 2025: Update README and verify remediation.

Conclusion

Remediating the 2 findings related to SI-2 controls is a critical step in ensuring the security and integrity of our system. By following the remediation plan outlined above, we can ensure that our system is secure and compliant with SI-2 controls.

Introduction

In our previous article, we outlined the steps to be taken to remediate the 2 findings related to SI-2 controls that were identified by a WebInspect scan in February 2025. In this article, we will answer some of the frequently asked questions (FAQs) related to this issue.

Q: What are SI-2 controls?

A: SI-2 controls are a set of security and compliance controls that are designed to ensure the confidentiality, integrity, and availability of sensitive information. These controls are critical in preventing unauthorized access, data breaches, and other security threats.

Q: What are the two findings related to SI-2 controls that need to be remediated or flagged as false positives?

A: The two findings related to SI-2 controls that need to be remediated or flagged as false positives are:

Cache management: headers: This finding indicates that the system is not properly managing cache headers, which can lead to security vulnerabilities.
HTML5: CORS Prolonged Caching of Preflight Response: This finding indicates that the system is not properly configuring CORS (Cross-Origin Resource Sharing) policies, which can lead to security vulnerabilities.

Q: What is the impact of not remedying these findings?

A: If these findings are not remedied, it can lead to security vulnerabilities that can be exploited by attackers. This can result in unauthorized access to sensitive information, data breaches, and other security threats.

Q: How can I verify that the findings are legitimate?

A: To verify that the findings are legitimate, you can review the WebInspect scan results and consult with the security team. You can also run additional tests to confirm the findings.

Q: What is the timeline for remediation?

A: The following timeline is proposed for remediation:

End of February 2025: Verify finding and resolve finding (if needed) or document justification for false-positive.
End of March 2025: Run Testing Checklist and confirm all tests pass.
End of March 2025: Update README and verify remediation.

Q: Can this ticket be prioritized for implementation by end of March 2025?

A: Yes, this ticket can be prioritized for implementation by end of March 2025. However, it is essential to ensure that the remediation is successful and that all tests pass before considering the issue closed.

Q: What is the role of the security team in remediation?

A: The security team plays a critical role in remediation by providing guidance and support to the development team. They can also review the remediation plan and provide feedback to ensure that it is effective.

Q: How can I get more information about SI-2 controls?

A: You can get more information about SI-2 controls by consulting the NIST SP 800-53 R4 documentation. You can also consult with the security team or other experts in the field.

Q: What is the next step after remediation?

A: After remediation, the next step is to verify that the remediation was successful by re-running the WebInspect scan. You should also update the README file to reflect the changes made to address the findings.

Q: Can I get more information about the WebInspect scan results?

A: Yes, you can get more information about the WebInspect scan results by consulting the supporting documentation provided. You can also contact the security team or other experts in the field for more information.

Conclusion

In this article, we have answered some of the frequently asked questions (FAQs) related to remediating the 2 findings related to SI-2 controls. We hope that this information has been helpful in understanding the issue and the steps to be taken to remediate it. If you have any further questions, please do not hesitate to contact us.