← Back to Documentation

Best Practices

Security best practices, remediation workflows, and recommendations for building a mature application security program with Pemvosec.

Security Policies

Shift Left

Catch vulnerabilities early in the development process

  • Enable PR scanning to catch issues before merge
  • Integrate CLI into local development workflow
  • Set up pre-commit hooks for secret detection
  • Configure branch protection rules with security checks

Prioritize by Risk

Focus remediation efforts on highest-impact vulnerabilities

  • Use EPSS scores alongside CVSS for prioritization
  • Consider exploitability and asset criticality
  • Set SLAs based on severity: Critical (24h), High (7d), Medium (30d)
  • Track remediation metrics to measure improvement

Defense in Depth

Layer security controls across your stack

  • Enable multiple scan types: SAST, SCA, secrets, IaC
  • Combine endpoint protection with application security
  • Use zero trust principles for access control
  • Implement data loss prevention at multiple points

Continuous Monitoring

Security is not a one-time activity

  • Schedule daily scans for critical repositories
  • Enable real-time alerts for new critical findings
  • Review security posture dashboards weekly
  • Conduct quarterly security reviews

Remediation Workflows

Establish clear SLAs and workflows for addressing security findings based on severity.

Critical

SLA: 24 hours

  1. 1Immediately notify security team and dev lead
  2. 2Create high-priority ticket with auto-assignment
  3. 3Consider temporary mitigation (WAF rule, feature flag)
  4. 4Verify fix with rescan before closing
High

SLA: 7 days

  1. 1Add to current sprint backlog
  2. 2Assign to component owner
  3. 3Review for similar patterns in codebase
  4. 4Document fix for knowledge sharing
Medium

SLA: 30 days

  1. 1Add to technical debt backlog
  2. 2Group similar findings for batch fixes
  3. 3Consider during regular refactoring
  4. 4Track for compliance reporting
Low

SLA: 90 days

  1. 1Log for awareness
  2. 2Address opportunistically during related work
  3. 3Review for false positive patterns
  4. 4Consider automated fixing tools

Developer Guidelines

Secure Coding Practices

  • Validate and sanitize all user inputs at application boundaries
  • Use parameterized queries to prevent SQL injection
  • Encode outputs to prevent XSS attacks
  • Never hardcode secrets - use environment variables or secret managers
  • Keep dependencies updated and monitor for vulnerabilities

Code Review Checklist

  • -Are all Pemvosec findings addressed or documented?
  • -Are new dependencies from trusted sources with good security track records?
  • -Are authentication and authorization properly implemented?
  • -Is sensitive data properly encrypted at rest and in transit?
  • -Are error messages safe (no stack traces or internal details)?

False Positives

When marking findings as false positives, always document the reason. This trains the AI model and helps the team understand context.

Team Roles & Responsibilities

RoleResponsibilities
Security AdminConfigure blades, define policies, manage rules, review compliance reports
Security AnalystTriage findings, manage false positives, track remediation, generate reports
DeveloperReview PR findings, fix assigned vulnerabilities, follow secure coding guidelines
Tech LeadPrioritize security backlog, approve risk exceptions, drive architecture decisions
Tenant AdminManage users, assign roles, configure integrations, oversee subscription

Compliance & Reporting

Pemvosec maps findings to common compliance frameworks to help demonstrate security controls.

SOC 2

Service Organization Control 2

  • CC6.1 - Logical Access
  • CC7.1 - System Operations
  • CC8.1 - Change Management

ISO 27001

Information Security Management

  • A.12.6.1 - Vulnerability Management
  • A.14.2.1 - Secure Development Policy

PCI DSS

Payment Card Industry Data Security

  • Req 6.5 - Secure Coding
  • Req 6.6 - Web Application Security

HIPAA

Health Insurance Portability and Accountability

  • 164.312(a)(1) - Access Control
  • 164.312(e)(1) - Transmission Security

Recommended Reports

Generate these reports regularly for stakeholders

Executive Summary

Monthly - for leadership

  • - Security score trend
  • - Critical/high findings count
  • - Remediation velocity

Technical Report

Weekly - for dev teams

  • - New findings breakdown
  • - Open findings by repo
  • - SLA compliance status

Compliance Report

Quarterly - for auditors

  • - Control mapping
  • - Evidence artifacts
  • - Exception log

Quick Tips

  • Start with high-risk repositories

    Prioritize scanning repositories that handle sensitive data or are internet-facing.

  • Train developers on security findings

    Hold monthly sessions to review common vulnerabilities and prevention techniques.

  • Use AI fix suggestions

    Leverage AI-generated fix suggestions to speed up remediation and educate developers.

  • Document exceptions with context

    When accepting risk, document the business justification and planned mitigation timeline.

  • Celebrate security wins

    Recognize teams that achieve security milestones to build a positive security culture.