5.4 SCOPE 5.4.1 The testing laboratory shall conduct the following tasks in around 3 – 5 working days, inclusive of submission of the full report. Software Errors 5.4.2 Binary Code Analysis tool is used to identify common flaws such as buffer overflows. It is expected that there can be multiple false positives in the test results. The testing laboratory, together with the developer, is expected to evaluate all relevant findings. 5.4.3 For positive findings, the developer must apply remediation procedures. Following remediation procedures, the testing laboratory shall make re-test the binary code. The remediated findings and the remediation steps must be included in the report to CCC. 5.4.4 For each false positive, the testing laboratory must provide sufficient justification to explain why the finding is a false positive. Vulnerabilities in third party libraries/components, and hard-coded sensitive security parameters 5.4.5 A Software Composition analyser is used to identify the usage of any thirdparty libraries and for such libraries, whether any known vulnerabilities (CVEs) are reported. The Software Composition analyser may also discover any hard-coded sensitive security parameters. 5.4.6 If the developer has successfully implemented the development process requirements specified in Tier 2, it is expected that the list of findings reported by the Software Composition analyser should be minimal. 5.4.7 Nonetheless, in some unexpected situations, the list of identified vulnerabilities might remain significant. For such situations, the developer is strongly encouraged to withdraw the application and focus on remediating the flaws, rather than incurring unnecessary cost to proceed with the application process. 5.4.8 Both the unfiltered (full list of identified vulnerabilities) and the filtered report will be used by the testing laboratory and the developer. The filtered report aims to assist the testing laboratory in prioritising the vulnerabilities to examine. Filtering is based on the following rules: • • • • • Commonly used libraries that potentially have external interfaces that could be exploited; CVSS Attack Vector (AV): Network (N); CVSS Attack Complexity (AC): Low (L); CVSS Confidentiality (C): High/Low; CVSS Integrity (I): High/Low; CLS Publication #2 | Page 11 of 49